eslint-plugin-security

ESLint plugin providing security-focused lint rules for Node.js applications, maintained by eslint-community. Current stable version is 4.0.0 (released 2026-02-19), with a slower release cadence of major versions every ~2 years. Key differentiators: it identifies potential security hotspots like eval() with expressions, unsafe Buffer usage, and child_process exec() calls; integrates as a recommended flat config for ESLint 9+; replaced the legacy eslintrc config with flat config (breaking change), and has dropped support for older Node versions. Currently in active development.