Registry / testing / eslint-plugin-redos

eslint-plugin-redos

JSON →
library4.5.0jsnpmunverified

ESLint plugin that detects ReDoS (Regular Expression Denial of Service) vulnerabilities using the recheck engine. Currently at v4.5.0 (stable), with v4.6.0-beta series adding ESLint flat config support and Apple M1 native binaries. It uses a static analysis engine (Scala-based) to identify exponential or polynomial worst-case behavior in regex patterns, differentiating it from simple regex linting rules. Requires Node >=20 and ESLint >=3. Release cadence is irregular with beta versions addressing platform support.

npm install eslint-plugin-redos
INSTALL
IMPORT
SIG · ESLINT-PLUGIN-REDO
E
eslint-plugin-redos
testingjavascriptv4.5.0
Install
Import
Disk
Pass rate
0/ 6
Env Coverage0 / 6
glibc
1822
musl
1822
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18226 runs
build_error
glibc
node 18226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

plugin
import plugin from 'eslint-plugin-redos'
import { plugin } from 'eslint-plugin-redos'
Default export is the plugin object. Named export pattern is not available. In CommonJS: const plugin = require('eslint-plugin-redos').
rule
import plugin from 'eslint-plugin-redos'; const rule = plugin.rules['no-redos'];
import { rules } from 'eslint-plugin-redos'
Rules are accessed via the plugin's default export. The rule name is 'no-redos'. TypeScript users can import type definitions if bundled.
configs
import plugin from 'eslint-plugin-redos'; const recommended = plugin.configs.recommended;
import { recommended } from 'eslint-plugin-redos'
Configs are nested under the default export. Use plugin.configs.recommended to extend the recommended configuration.

Shows how to configure the plugin in both legacy and flat ESLint config, enabling the no-redos rule.

// .eslintrc.js (ESLint <9) or eslint.config.js (flat config) // Legacy config: module.exports = { plugins: ['redos'], rules: { 'redos/no-redos': 'error' } }; // Flat config (ESLint >=9, requires v4.6.0-beta or later): import plugin from 'eslint-plugin-redos'; export default [ { plugins: { redos: plugin }, rules: { 'redos/no-redos': 'error' } } ];
Debug
Known issues
breakingv4.x requires Node >=20. Older Node versions are incompatible.
fix
Upgrade Node.js to version 20 or higher.
affects: >=4.0.0
deprecatedESLint flat config support is only available in v4.6.0-beta and later. v4.5.0 stable does not support flat config.
fix
Use legacy .eslintrc config or upgrade to v4.6.0-beta.
affects: >=4.0.0 <4.6.0-beta
gotchaThe plugin uses native binaries via 'recheck' package; on unsupported architectures (e.g., ARM Linux) it may fall back to JavaScript with degraded performance.
fix
If on ARM Linux, ensure platform-specific optional dependency is installed or use explicitly by installing recheck-linux-arm64.
affects: >=4.0.0
gotchaThe rule 'no-redos' only checks static regex literals, not dynamically constructed regexes from variables.
fix
Review dynamic regex constructions separately, or use additional analysis tools.
affects: >=1.0.0
Errors
Common errors & fixes
Error: Cannot find module 'eslint-plugin-redos'
Missing or incorrect installation of the plugin.
fix
Run 'npm install eslint-plugin-redos --save-dev' and ensure it's listed in package.json devDependencies.
ESLintError: Configuration for rule 'no-redos' is invalid. Value "error" is not an allowed value.
Using flat config with a version before v4.6.0-beta that doesn't support the 'error' severity string in flat config format.
fix
Upgrade to v4.6.0-beta or later, or use legacy config where severity strings are allowed.
TypeError: plugin.rules is not iterable
Trying to access rules from a named export instead of the default export.
fix
Use 'import plugin from 'eslint-plugin-redos'' instead of 'import { plugin } ...' then access plugin.rules.
Upgrade
Version history
4.5.0latest on npm
Audit
Dependencies
eslintrequiredpeer dependency required as the plugin runs within ESLint
Agent activity
9 hits · last 30 days
node
8
OpenAI (training)
1
Resources
eslint-plugin-redos — npm install eslint-plugin-redos · libregistry