Skip to content

chore: bump ESLint stack to v15 and migrate to flat config - #317

Open
cryptodev-2s wants to merge 4 commits into
mainfrom
migrate/pr2c-eslint
Open

chore: bump ESLint stack to v15 and migrate to flat config#317
cryptodev-2s wants to merge 4 commits into
mainfrom
migrate/pr2c-eslint

Conversation

@cryptodev-2s

@cryptodev-2s cryptodev-2s commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Stacked on #314.

Replaces .eslintrc.js with a flat eslint.config.mjs and moves the ESLint stack to core's versions.

Dep From To
eslint ^8.44.0 ^9.39.1
@metamask/eslint-config{,-jest,-nodejs,-typescript} ^12.0.0 ^15.0.0
@metamask/auto-changelog ^3.1.0 ^6.1.0
eslint-plugin-jest ^27.2.2 ^28.8.3
eslint-plugin-jsdoc ^39.9.1 ^50.2.4
eslint-plugin-n ^15.7.0 ^17.10.3
eslint-plugin-promise ^6.1.1 ^7.1.0

Drops eslint-plugin-import and @typescript-eslint/{parser,eslint-plugin} for eslint-plugin-import-x and typescript-eslint. Adds @types/semver@^7, which had been arriving transitively through @typescript-eslint/eslint-plugin and broke the build once that was removed.

Config v15 surfaced 351 problems v12 never enforced. Stylistic ones are off with TODO comments, matching core. The rest were stale directives naming rules that typescript-eslint v8 renamed or removed, so the code under them was going unchecked:

Directive Fate Sites
@typescript-eslint/no-throw-literal renamed to only-throw-error 8
@typescript-eslint/ban-types split in v8, no longer needed here 3
import/no-nodejs-modules now import-x/no-nodejs-modules 1 block
jest/no-if removed in eslint-plugin-jest v28 1

Two autofixes are reverted because they changed behaviour rather than style:

  1. hasProperty's constraint was rewritten from Object to object. The original carried an explicit suppression, so Object was deliberate: it accepts boxed primitives, and narrowing it breaks callers passing a string or number.
  2. json.test-d.ts lost as any and as number | undefined from its tsd assertions. In type tests the assertion is the test. no-unnecessary-type-assertion is now off for *.test-d.ts.

jsdoc/require-jsdoc stays off rather than suppressed: its autofixer inserted 193 empty JSDoc blocks on the first pass. Core disables it for the same reason.


Note

Low Risk
Tooling and lint-only source edits; no intentional runtime behavior changes beyond type-only export syntax for a few modules.

Overview
Migrates linting from legacy .eslintrc.js to ESLint 9 flat config in eslint.config.mjs, bumping @metamask/eslint-config (and jest/nodejs/typescript presets) to v15 and aligning related devDependencies (eslint-plugin-import-x, typescript-eslint, plugin major bumps, @types/semver as a direct dep).

lint:eslint drops --ext js,ts; new config adds file-specific overrides (JSDoc/TS rules left off with TODOs like core, *.test-d.ts and crypto polyfill tests exempted, uuid ignored for import-x).

Source updates are mostly lint hygiene: renamed rule directives (only-throw-error, import-x/no-nodejs-modules), removed stale eslint-disable blocks in fixtures, targeted suppressions where autofix would change behavior (hasProperty still uses Object, JsonRpcFailureStruct keeps a type assertion for published types). src/index.ts switches several modules to export type * so only types are re-exported.

Reviewed by Cursor Bugbot for commit 66665c1. Bugbot is set up for automated code reviews on this repo. Configure here.

@socket-security

socket-security Bot commented Sep 4, 2026

Copy link
Copy Markdown

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
System shell access: npm napi-postinstall in module node:child_process

Module: node:child_process

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/napi-postinstall@0.3.4

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm unrs-resolver in module child_process

Module: child_process

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/unrs-resolver@1.12.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unrs-resolver@1.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm @emnapi/core in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm @octokit/request in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/@metamask/auto-changelog@6.2.1npm/@octokit/request@8.4.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@octokit/request@8.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm @tybys/wasm-util in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@tybys/wasm-util@0.10.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm eslint-plugin-n in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/eslint-plugin-n@17.24.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-n@17.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm napi-postinstall in module node:http

Module: node:http

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/napi-postinstall@0.3.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm napi-postinstall in module node:https

Module: node:https

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/napi-postinstall@0.3.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Network access: npm napi-postinstall in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/napi-postinstall@0.3.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: npm unrs-resolver during postinstall

Install script: postinstall

Source: node postinstall.js

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/unrs-resolver@1.12.2

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unrs-resolver@1.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly

Notes: No overt data theft, network exfiltration, cryptomining, or backdoor installation is visible. However, the module includes strong dynamic execution sinks: napi_run_script uses g.eval(...) and emnapiCreateFunction uses new Function(...) to create named wrappers. These are high-risk patterns in supply-chain reviews; if the parent project exposes these APIs to untrusted input (directly or indirectly from Wasm), it could enable arbitrary code execution. The rest of the code is largely Wasm memory/handle marshaling typical of N-API glue runtimes.

Confidence: 0.62

Severity: 0.55

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly

Notes: Primary concern is direct dynamic code execution. napi_run_script uses eval() on a string originating from wasm-provided input, and ee uses new Function(...) to construct wrapper functions. If the wasm module or its inputs are attacker-controlled, this provides JavaScript code execution in the host context. Aside from these dynamic execution sinks, the remaining code mainly performs wasm memory/table management and worker async orchestration typical of such runtimes, with no clear hardcoded exfiltration or backdoor behavior in this fragment.

Confidence: 0.62

Severity: 0.68

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @emnapi/core is 66.0% likely to have a medium risk anomaly

Notes: No explicit evidence of overt malware (network exfiltration, credential theft, backdoors, or filesystem/process activity) appears in this fragment. However, the module contains high-sensitivity dynamic execution capabilities: napi_run_script performs eval-like execution of a JavaScript string obtained from WebAssembly, and emnapiCreateFunction can use the Function constructor for wrapper generation. Combined with wasm-driven indirect callback dispatch and reflective object mutation, this runtime is security-sensitive and should only be used with fully trusted WebAssembly and tightly controlled inputs.

Confidence: 0.66

Severity: 0.66

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @emnapi/core is 66.0% likely to have a medium risk anomaly

Notes: This module appears to be a legitimate wasm-to-JS/Node-API bridge/runtime, but it contains high-impact dynamic execution capabilities: napi_run_script uses eval() on a string originating from the WASM/handle side, and the binding layer can generate functions via new Function(). It also performs indirect host callback invocation based on runtime handles selected by worker/work-queue control. No explicit exfiltration/backdoor behavior is visible in the provided fragment, so malware likelihood is low, but security risk is moderate-to-high due to host-context code execution if the WASM module or its inputs are not fully trusted.

Confidence: 0.66

Severity: 0.68

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @emnapi/core reads NODE_ENV

Env Vars: NODE_ENV

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @emnapi/runtime reads NODE_ENV

Env Vars: NODE_ENV

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/runtime@1.10.0

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @emnapi/wasi-threads reads NODE_ENV

Env Vars: NODE_ENV

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@emnapi/wasi-threads@1.2.1

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @metamask/auto-changelog

Location: Package overview

From: package.jsonnpm/@metamask/auto-changelog@6.2.1

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @metamask/auto-changelog reads npm_package_repository_url

Env Vars: npm_package_repository_url

Location: Package overview

From: package.jsonnpm/@metamask/auto-changelog@6.2.1

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @metamask/auto-changelog reads PROJECT_CWD

Env Vars: PROJECT_CWD

Location: Package overview

From: package.jsonnpm/@metamask/auto-changelog@6.2.1

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): npm @tybys/wasm-util is 65.0% likely to have a medium risk anomaly

Notes: No direct evidence of intentional malware, obfuscation-based payload hiding, or covert network exfiltration in this fragment. The primary security concerns are design/capability risks typical of WASI runtimes: executing externally provided WASM, high-impact filesystem access via injected fs/preopens, environment-variable exposure to the guest, possible host termination via proc_exit, and non-malicious operational risks (busy-wait timer handling and window.prompt stdin blocking; weak RNG fallback to Math.random). Risk is therefore configuration- and trust-boundary-dependent rather than a confirmed implant.

Confidence: 0.65

Severity: 0.52

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@tybys/wasm-util@0.10.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @tybys/wasm-util

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@tybys/wasm-util@0.10.3

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @tybys/wasm-util reads NODE_ENV

Env Vars: NODE_ENV

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@tybys/wasm-util@0.10.3

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Environment variable access: npm @tybys/wasm-util reads NODE_DEBUG_NATIVE

Env Vars: NODE_DEBUG_NATIVE

Location: Package overview

From: package.jsonnpm/eslint-plugin-import-x@4.17.1npm/eslint-import-resolver-typescript@3.10.1npm/@tybys/wasm-util@0.10.3

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 20 more rows in the dashboard

View full report

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 6551ea9. Configure here.

Comment thread src/json.ts Outdated
Replaces .eslintrc.js with eslint.config.mjs and moves the whole ESLint
stack to the versions core uses.

  eslint                              ^8.44.0  -> ^9.39.1
  @metamask/eslint-config*            ^12.0.0  -> ^15.0.0
  @metamask/auto-changelog            ^3.1.0   -> ^6.1.0
  eslint-plugin-jest                  ^27.2.2  -> ^28.8.3
  eslint-plugin-jsdoc                 ^39.9.1  -> ^50.2.4
  eslint-plugin-n                     ^15.7.0  -> ^17.10.3
  eslint-plugin-promise               ^6.1.1   -> ^7.1.0
  eslint-plugin-import                removed, replaced by import-x
  @typescript-eslint/{parser,plugin}  removed, replaced by typescript-eslint

Added: typescript-eslint ^8.48.0, eslint-plugin-import-x ^4.3.0,
eslint-import-resolver-typescript ^3.6.3, @types/eslint ^9.6.1.

The flat config carries over the prettier/prettier and import-x/order
disables set in .eslintrc.js by the previous commit, since Oxfmt owns
formatting.

Also adds @types/semver ^7. It was previously reaching us transitively via
@typescript-eslint/eslint-plugin, so dropping that package broke the build
until it was declared directly.

Config v15 surfaced problems v12 never enforced. Most are stylistic and are
turned off with TODO comments, matching core. The rest were stale
eslint-disable directives pointing at rules typescript-eslint v8 renamed or
removed:

  @typescript-eslint/no-throw-literal -> only-throw-error   (8 sites)
  @typescript-eslint/ban-types        -> now unnecessary    (3 sites)
  jest/no-if                          -> removed in v28     (1 site)

Two autofixes were reverted because they changed behaviour rather than style:

  hasProperty's constraint was rewritten from `Object` to `object`. The
  original carried an explicit suppression, so it was deliberate: `Object`
  accepts boxed primitives, and narrowing it would break callers passing a
  string or number.

  In json.test-d.ts the fixer stripped `as any` and `as number | undefined`
  from tsd assertions. Those assertions are the test. no-unnecessary-type-
  assertion is now off for *.test-d.ts so it cannot happen again.

jsdoc/require-jsdoc stays off for the same reason core keeps it off: its
autofixer inserts empty JSDoc blocks and mangles the surrounding code.

Verified: eslint, build, 23 suites / 1993 tests at 100% coverage, tsd, and
the full yarn lint all pass.
It was copied from smart-transactions-controller#595 without checking
whether this package needs it. It does not: nothing here imports eslint
types, eslint.config.mjs carries no annotations, and it is only an optional
peer of eslint-plugin-prettier. Core does not have it at its root either.

Removing it changes nothing: eslint, build, tests and lint all still pass.
@cryptodev-2s
cryptodev-2s force-pushed the migrate/pr2c-eslint branch 2 times, most recently from 0418ea3 to cb576bc Compare September 7, 2026 12:31
@cryptodev-2s
cryptodev-2s removed this pull request from stack #329 September 9, 2026 11:46
@cryptodev-2s
cryptodev-2s added this pull request to stack #331 September 9, 2026 11:47
Removing the stale eslint-disable comments left their newlines in place, so
16 stray blank lines ended up between JSDoc blocks and the declarations they
document, and inside parameter lists.

The cause is the autofixer for reportUnusedDisableDirectives: it deletes the
directive text but not the line it sat on. I ran eslint --fix and did not
review the whitespace only part of the diff.

Nothing in the toolchain flags this. lines-around-comment,
@typescript-eslint/lines-around-comment and no-multiple-empty-lines are all
off in the shared config, and Oxfmt only collapses two or more consecutive
blank lines, treating a single one as deliberate.

Cosmetic rather than functional: TypeScript still associates a JSDoc block
with the declaration across a blank line, verified by emitting declarations
for both shapes and confirming the comment survives in the .d.ts.
Comment thread src/index.ts
export * from './coercers';
export * from './collections';
export * from './encryption-types';
export type * from './encryption-types';

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@typescript-eslint/consistent-type-exports

…ion emit

no-unnecessary-type-assertion flagged `JsonRpcErrorStruct as Struct<JsonRpcError>`
and its autofixer removed it. The rule is right that the assertion does not
change assignability, and wrong that it is unnecessary: it pins what
TypeScript emits.

Without it the declaration inlines the structure instead of referring to the
named type, so JsonRpcFailure and JsonRpcResponse changed from

  error: JsonRpcError;

to an anonymous object literal, which also pushed the unexported internal
ExactOptionalGuard further into the published types (9 occurrences in
json.d.cts before, 11 after).

Restored with a suppression explaining why. json.d.cts is now byte identical
to the one built from main.

Found by diffing the emitted declarations against main rather than by any
test: assignability is unchanged, so nothing fails. Only the shape of the
published types differs.

@mcmire mcmire left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for doing this. This mostly looks good but I called out some things below. I need to do another pass on this but I do have a suggestion to consider below for now.

Comment thread src/hex.test.ts
@@ -1,3 +1,8 @@
/* eslint-disable @typescript-eslint/no-unnecessary-type-assertion --
The `as Hex` assertions in the `it.each` tables below look redundant per

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if we convert as Hex to as const instead, would we then need this?

Comment thread src/misc.ts
/**
* Predefined sizes (in Bytes) of specific parts of JSON structure.
*/
/* eslint-disable @typescript-eslint/no-duplicate-enum-values --

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine for now. When we ban enums finally this should go away, so nothing to worry about.

Comment thread eslint.config.mjs
rules: {
// TODO: Re-enable these rules.
// Newly surfaced by eslint-config v15; not enforced under v12.
'@typescript-eslint/explicit-function-return-type': 'off',

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, I thought I fixed this already. I guess not. This is okay for now.

Comment thread eslint.config.mjs
settings: {
// `uuid` ships an exports map that the TypeScript resolver cannot read,
// so `import-x` sees no named exports and false positives on `uuid.v4`.
'import-x/ignore': ['uuid'],

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, interesting. Are we using the ESM version of uuid? We've never had to do this before so it feels like there ought to be another way to do this.

Comment thread eslint.config.mjs
{
files: ['**/*.test.{js,ts}'],
rules: {
// These tests deliberately reach for `crypto` and `crypto.webcrypto`,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably okay, but I need to double-check this is the right thing to do here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants