Registry / auth-security / eslint-plugin-no-secrets

eslint-plugin-no-secrets

library2.3.3jsnpmunverified

An ESLint plugin that provides a single rule (`no-secrets`) to detect potential secrets, API keys, tokens, or other sensitive data hardcoded in source code. Version 2.3.3 (stable, maintained as of early 2025) supports Node >=18 and npm >=8. It uses a configurable regex-based pattern matching approach, with a default set of patterns for common secret formats (e.g., AWS keys, GitHub tokens, private keys). Unlike generic secret scanners, it integrates directly into ESLint workflows and supports per-file ignore lists via inline comments. The rule can be tuned by adding custom patterns or adjusting entropy thresholds. Ships TypeScript definitions.

auth-security testing type-stubs

npm install eslint-plugin-no-secrets

github ↗package ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-NO-S

eslint-plugin-no-secrets

auth-securityjavascriptv2.3.3

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import noSecrets from 'eslint-plugin-no-secrets';

✗ const noSecrets = require('eslint-plugin-no-secrets');

ESM module; default export is the plugin object. Require still works for CommonJS projects using dynamic import or bundler interop, but direct CJS require may not work in Node ESM-only environments.

rules

✓ import { rules } from 'eslint-plugin-no-secrets';

✗ const { rules } = require('eslint-plugin-no-secrets');

Named export for accessing the rule map. CJS require is available but discouraged in ESM projects.

configs

✓ import { configs } from 'eslint-plugin-no-secrets';

Named export for preset configurations (e.g., configs.recommended). Available as named export from package root.

Shows how to enable the `no-secrets` plugin and rule in an ESLint flat config (ESM). Uses dynamic import because the plugin is ESM by default.

// .eslintrc.js (ESM) export default { plugins: { 'no-secrets': (await import('eslint-plugin-no-secrets')).default }, rules: { 'no-secrets/no-secrets': 'error', }, };

Debug

Known issues

gotchaRule may flag false positives for non-secret strings that match regex patterns (e.g., '12345' as an API key).

fix

Tune patterns per project, add violations to ignore list via inline comment `// eslint-disable-next-line no-secrets/no-secrets` or configure `ignore` option in rule settings.

affects: >=1.0.0

gotchaHigh-entropy detection can mark random-looking strings (e.g., UUIDs) as secrets.

fix

Adjust `entropy` option threshold or add `ignore` patterns to exclude known non-secrets.

affects: >=1.0.0

gotchaPlugin requires ESLint >=5; older ESLint versions will not work.

fix

Upgrade ESLint to version 5 or later.

affects: >=2.0.0

breakingVersion 2.0.0 dropped support for Node <18 and npm <8. Breaking for projects on older runtimes.

fix

Upgrade Node to >=18 and npm to >=8.

affects: 2.0.0 - 2.3.3

deprecatedThe old `.eslintrc`-style configuration using `extends: ['plugin:no-secrets/recommended']` is deprecated in favor of flat config.

fix

Switch to flat config format with explicit plugin import and rules declaration.

affects: >=2.0.0

Errors

Common errors & fixes

ESLint couldn't find the plugin "eslint-plugin-no-secrets".

Plugin not installed or not in node_modules.

fix

Run `npm install eslint-plugin-no-secrets --save-dev`.

Definition for rule 'no-secrets/no-secrets' was not found.

Plugin not registered in ESLint config.

fix

Add 'no-secrets' to plugins array in ESLint config.

Cannot find module 'eslint-plugin-no-secrets'

Missing or wrong import path in flat config.

fix

Use `await import('eslint-plugin-no-secrets')` or ensure the package is installed.

Upgrade

Version history

2.3.3latest on npm

Audit

Dependencies

eslintrequiredpeer dependency; plugin runs as an ESLint rule

Agent activity

48 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/nickdeis/eslint-plugin-no-secrets ↗

packagehttps://www.npmjs.com/package/eslint-plugin-no-secrets ↗