Is eslint (npm) safe to install?

Is eslint safe? npm package security — ShadowCanopy

Safe to use

Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.

Scanned 8/7/2026

Approvedeslint@10.8.1View on registry ↗latest: 10.8.1

All flagged patterns are benign: unicode line/paragraph separators and BOM handling are required for correct JS source parsing (see LINEBREAKS, char-source escape handling, no-irregular-whitespace rule, and BOM logic). Regexes matching Function* nodes and long GitHub URLs in comments are ordinary. No credential access, exfiltration, remote execution, or other harmful behavior exists in the provided source.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

ESLint is an AST-based pattern checker for JavaScript that provides linting rules, a CLI, and supporting libraries.

Capabilities

Provides eslint CLI binary
Includes extensive JavaScript lint rules and linter
Runs build/test/release via node Makefile.js and mocha
Depends on cross-spawn for child processes

Data access

Filesystem
Environment variables

Network

No network access observed

Widely used development tool; multiple static findings flag obfuscated source files that may require verification before use.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

75 packages31 direct

eslint@10.8.116 findings

ajv@8.20.04 findings

debug@4.4.3

espree@11.2.0

ignore@7.0.64 findings

esquery@1.7.08 findings

esutils@2.0.32 findings

find-up@8.0.0

is-glob@4.0.3

minimatch@10.2.6

optionator@0.9.4

cross-spawn@7.0.6

glob-parent@6.0.2

imurmurhash@0.1.4

@eslint/core@1.2.1

eslint-scope@9.1.22 findings

@humanfs/node@0.16.8

@types/estree@1.0.9

fast-deep-equal@3.1.3

natural-compare@1.4.0

file-entry-cache@11.1.5

@eslint/plugin-kit@0.7.2

eslint-visitor-keys@5.0.1

@eslint/config-array@0.23.58 findings

@humanwhocodes/retry@0.4.3

escape-string-regexp@5.0.0

@eslint/config-helpers@0.7.0

@eslint-community/regexpp@4.12.22 findings

@eslint-community/eslint-utils@4.10.1

@humanwhocodes/module-importer@1.0.1

json-stable-stringify-without-jsonify@1.0.1

Obfuscated / hidden code

Encoded payloads decoded statically (without executing them) so you can see what they resolve to.

Obfuscated source filelib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in lib/rules/no-irregular-whitespace.js

Obfuscated source filepackage/lib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in package/lib/rules/no-irregular-whitespace.js

Security findings (16)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023lib/rules/utils/ast-utils.js

Multiple obfuscation patterns in lib/rules/utils/ast-utils.js

mediumObfuscated source fileATK-023package/lib/rules/utils/ast-utils.js

Multiple obfuscation patterns in package/lib/rules/utils/ast-utils.js

mediumObfuscated source fileATK-023lib/rules/utils/char-source.js

Multiple obfuscation patterns in lib/rules/utils/char-source.js

mediumObfuscated source fileATK-023package/lib/rules/utils/char-source.js

Multiple obfuscation patterns in package/lib/rules/utils/char-source.js

mediumObfuscated source fileATK-023lib/linter/linter.js

Multiple obfuscation patterns in lib/linter/linter.js

mediumObfuscated source fileATK-023package/lib/linter/linter.js

Multiple obfuscation patterns in package/lib/linter/linter.js

mediumObfuscated source fileATK-023lib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in lib/rules/no-irregular-whitespace.js

mediumObfuscated source fileATK-023package/lib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in package/lib/rules/no-irregular-whitespace.js

mediumObfuscated source fileATK-023lib/rules/no-return-await.js

Multiple obfuscation patterns in lib/rules/no-return-await.js

mediumObfuscated source fileATK-023package/lib/rules/no-return-await.js

Multiple obfuscation patterns in package/lib/rules/no-return-await.js

mediumObfuscated source fileATK-023lib/rules/no-underscore-dangle.js

Multiple obfuscation patterns in lib/rules/no-underscore-dangle.js

mediumObfuscated source fileATK-023package/lib/rules/no-underscore-dangle.js

Multiple obfuscation patterns in package/lib/rules/no-underscore-dangle.js

mediumObfuscated source fileATK-023lib/rules/no-useless-return.js

Multiple obfuscation patterns in lib/rules/no-useless-return.js

mediumObfuscated source fileATK-023package/lib/rules/no-useless-return.js

Multiple obfuscation patterns in package/lib/rules/no-useless-return.js

mediumObfuscated source fileATK-023lib/types/rules.d.ts

Multiple obfuscation patterns in lib/types/rules.d.ts

mediumObfuscated source fileATK-023package/lib/types/rules.d.ts

Multiple obfuscation patterns in package/lib/types/rules.d.ts

Package metadata

LicenseMIT

An AST-based pattern checker for JavaScript.

Homepage ↗Repository ↗

Files in package (500)

LICENSEpackage/LICENSElib/rules/accessor-pairs.jspackage/lib/rules/accessor-pairs.jslib/shared/ajv.jspackage/lib/shared/ajv.jsmessages/all-matched-files-ignored.jspackage/messages/all-matched-files-ignored.jslib/api.jspackage/lib/api.jslib/linter/apply-disable-directives.jspackage/lib/linter/apply-disable-directives.jslib/rules/array-bracket-newline.jspackage/lib/rules/array-bracket-newline.jslib/rules/array-bracket-spacing.jspackage/lib/rules/array-bracket-spacing.jslib/rules/array-callback-return.jspackage/lib/rules/array-callback-return.jslib/rules/array-element-newline.jspackage/lib/rules/array-element-newline.jslib/rules/arrow-body-style.jspackage/lib/rules/arrow-body-style.jslib/rules/arrow-parens.jspackage/lib/rules/arrow-parens.jslib/rules/arrow-spacing.jspackage/lib/rules/arrow-spacing.jslib/shared/assert.jspackage/lib/shared/assert.jslib/rules/utils/ast-utils.jspackage/lib/rules/utils/ast-utils.jslib/shared/ast-utils.jspackage/lib/shared/ast-utils.jslib/languages/js/source-code/token-store/backward-token-comment-cursor.jspackage/lib/languages/js/source-code/token-store/backward-token-comment-cursor.jslib/languages/js/source-code/token-store/backward-token-cursor.jspackage/lib/languages/js/source-code/token-store/backward-token-cursor.jslib/rules/block-scoped-var.jspackage/lib/rules/block-scoped-var.jslib/rules/block-spacing.jspackage/lib/rules/block-spacing.js

How ShadowCanopy checks npm packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other npm packages

express react react-dom lodash axios chalk commander next typescript webpack vite prettier

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/eslint

eslint — deep security report