Is eslint (npm) safe to install?

Is eslint safe? npm package security — ShadowCanopy

Safe to use

Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.

Scanned 9/19/2026

Approvedeslint@10.11.0View on registry ↗latest: 10.11.0

All findings are false positives from the 'obfuscated source' heuristic. The flagged patterns (Function( regexes, \u2028/\u2029/\uFEFF escapes, String.fromCharCode, long URLs, descriptive long identifiers) are normal, legitimate code in ESLint's AST utilities, whitespace rules, escape-sequence parser, and linter core. No malicious behavior (theft, exfil, RCE, C2, etc.) is present.

Protect your projects free

AI breakdown

Plain-English summary of what this package does and how it behaves.

eslint is an AST-based pattern checker for JavaScript that provides a CLI tool and API for linting code according to configurable rules.

Capabilities

Provides eslint CLI via bin/eslint.js
Includes extensive set of linting rules in lib/rules
Supports npm scripts for build, test, and lint tasks
Depends on cross-spawn for process spawning

Data access

Filesystem
None observed for environment variables or other sensitive data

Network

No network access observed

Standard development tool with many dependencies and repeated static findings of obfuscated source files; review findings and dependencies before use in production environments.

Dependency & execution chain

Every package this one pulls in, colored by verdict. Expand to walk the tree.

75 packages31 direct1 flagged

eslint@10.11.016 findings

ajv@8.20.04 findings

debug@4.4.3

espree@11.2.0

ignore@7.0.10

esquery@1.7.08 findings

esutils@2.0.32 findings

find-up@8.0.0

is-glob@4.0.3

minimatch@10.2.6

optionator@0.9.4

cross-spawn@7.0.6

glob-parent@6.0.2

imurmurhash@0.1.4

@eslint/core@1.2.1

eslint-scope@9.1.22 findings

@humanfs/node@0.17.0

@types/estree@1.0.9

fast-deep-equal@3.1.3

natural-compare@1.4.0

file-entry-cache@11.1.5

@eslint/plugin-kit@0.7.3

eslint-visitor-keys@5.0.1

@eslint/config-array@0.23.58 findings

@humanwhocodes/retry@0.4.3

escape-string-regexp@5.0.0

@eslint/config-helpers@0.7.0

@eslint-community/regexpp@4.12.22 findings

@eslint-community/eslint-utils@4.10.1

@humanwhocodes/module-importer@1.0.1

json-stable-stringify-without-jsonify@1.0.1

Obfuscated / hidden code

Encoded payloads decoded statically (without executing them) so you can see what they resolve to.

Obfuscated source filelib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in lib/rules/no-irregular-whitespace.js

Obfuscated source filepackage/lib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in package/lib/rules/no-irregular-whitespace.js

Security findings (16)

Static analysis rule matches, with the exact code that triggered them.

mediumObfuscated source fileATK-023lib/rules/utils/ast-utils.js

Multiple obfuscation patterns in lib/rules/utils/ast-utils.js

mediumObfuscated source fileATK-023package/lib/rules/utils/ast-utils.js

Multiple obfuscation patterns in package/lib/rules/utils/ast-utils.js

mediumObfuscated source fileATK-023lib/rules/utils/char-source.js

Multiple obfuscation patterns in lib/rules/utils/char-source.js

mediumObfuscated source fileATK-023package/lib/rules/utils/char-source.js

Multiple obfuscation patterns in package/lib/rules/utils/char-source.js

mediumObfuscated source fileATK-023lib/linter/linter.js

Multiple obfuscation patterns in lib/linter/linter.js

mediumObfuscated source fileATK-023package/lib/linter/linter.js

Multiple obfuscation patterns in package/lib/linter/linter.js

mediumObfuscated source fileATK-023lib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in lib/rules/no-irregular-whitespace.js

mediumObfuscated source fileATK-023package/lib/rules/no-irregular-whitespace.js

Multiple obfuscation patterns in package/lib/rules/no-irregular-whitespace.js

mediumObfuscated source fileATK-023lib/rules/no-return-await.js

Multiple obfuscation patterns in lib/rules/no-return-await.js

mediumObfuscated source fileATK-023package/lib/rules/no-return-await.js

Multiple obfuscation patterns in package/lib/rules/no-return-await.js

mediumObfuscated source fileATK-023lib/rules/no-underscore-dangle.js

Multiple obfuscation patterns in lib/rules/no-underscore-dangle.js

mediumObfuscated source fileATK-023package/lib/rules/no-underscore-dangle.js

Multiple obfuscation patterns in package/lib/rules/no-underscore-dangle.js

mediumObfuscated source fileATK-023lib/rules/no-useless-return.js

Multiple obfuscation patterns in lib/rules/no-useless-return.js

mediumObfuscated source fileATK-023package/lib/rules/no-useless-return.js

Multiple obfuscation patterns in package/lib/rules/no-useless-return.js

mediumObfuscated source fileATK-023lib/types/rules.d.ts

Multiple obfuscation patterns in lib/types/rules.d.ts

mediumObfuscated source fileATK-023package/lib/types/rules.d.ts

Multiple obfuscation patterns in package/lib/types/rules.d.ts

Package metadata

LicenseMIT

An AST-based pattern checker for JavaScript.

Homepage ↗Repository ↗

Files in package (500)

LICENSEpackage/LICENSElib/rules/accessor-pairs.jspackage/lib/rules/accessor-pairs.jslib/shared/ajv.jspackage/lib/shared/ajv.jsmessages/all-matched-files-ignored.jspackage/messages/all-matched-files-ignored.jslib/api.jspackage/lib/api.jslib/linter/apply-disable-directives.jspackage/lib/linter/apply-disable-directives.jslib/rules/array-bracket-newline.jspackage/lib/rules/array-bracket-newline.jslib/rules/array-bracket-spacing.jspackage/lib/rules/array-bracket-spacing.jslib/rules/array-callback-return.jspackage/lib/rules/array-callback-return.jslib/rules/array-element-newline.jspackage/lib/rules/array-element-newline.jslib/rules/arrow-body-style.jspackage/lib/rules/arrow-body-style.jslib/rules/arrow-parens.jspackage/lib/rules/arrow-parens.jslib/rules/arrow-spacing.jspackage/lib/rules/arrow-spacing.jslib/shared/assert.jspackage/lib/shared/assert.jslib/rules/utils/ast-utils.jspackage/lib/rules/utils/ast-utils.jslib/shared/ast-utils.jspackage/lib/shared/ast-utils.jslib/languages/js/source-code/token-store/backward-token-comment-cursor.jspackage/lib/languages/js/source-code/token-store/backward-token-comment-cursor.jslib/languages/js/source-code/token-store/backward-token-cursor.jspackage/lib/languages/js/source-code/token-store/backward-token-cursor.jslib/rules/block-scoped-var.jspackage/lib/rules/block-scoped-var.jslib/rules/block-spacing.jspackage/lib/rules/block-spacing.js

How ShadowCanopy checks npm packages

ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.

Protect your projects free See what's being blocked

Other npm packages

express react react-dom lodash axios chalk commander next typescript webpack vite prettier

This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/eslint

eslint — deep security report