ESLint security plugin

eslint --plugin security <path>

Scans JavaScript/TypeScript code with ESLint and the security plugin, detecting insecure language patterns.

Run it in the JS/TS project pipeline when you want static analysis with the ecosystem linter: eslint with the security plugin (eslint-plugin-security) analyzes the code and reports findings — eval, injection via query concatenation, dangerous regexes (ReDoS), insecure API usage — with the plugin's rules. It's the natural SAST integration in JS projects: the linter the team already uses, with security rules added. In JS/TS DevSecOps, eslint-security is the pipeline filter: high-severity findings block the merge (along with the rest of the linter rules).

Don't use it as a complete analysis: ESLint's security plugin covers language patterns (eval, injection) — dependency vulnerabilities (SCA, 020) and runtime behavior (DAST) are out of scope. And beware: the plugin is a layer over the linter — security rules are configured (community ones) and false positives are triaged (legitimate eval uses). For deep analysis, use semgrep/CodeQL; eslint-security is the linter ecosystem layer.