eslint@10.14.0 is the legitimate ESLint package. All flagged files (ast-utils.js, char-source.js, linter.js, no-irregular-whitespace.js, etc.) contain ordinary, readable ESLint source with no malicious behavior. The 'obfuscation' findings are false positives from unicode escapes and function names that are normal in this codebase.
AI breakdown
Plain-English summary of what this package does and how it behaves.
eslint is an AST-based pattern checker for JavaScript that provides linting via CLI and API. It includes a large set of built-in rules and supports configuration, testing, and release workflows through numerous npm scripts.
Capabilities
- Provides CLI entrypoint via bin/eslint.js
- Includes dozens of linting rules in lib/rules
- Runs node-based build, lint, and test scripts
- Depends on cross-spawn for child processes
Data access
- Filesystem (source files and caches)
- None observed for environment variables or other sensitive data
Network
- No network access observed
Widely used, mature open-source linter with transparent source layout; repeated static findings for obfuscated files are present but not evidenced in the sampled rule and library files.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Obfuscated / hidden code
Encoded payloads decoded statically (without executing them) so you can see what they resolve to.
Multiple obfuscation patterns in lib/rules/no-irregular-whitespace.js
Multiple obfuscation patterns in package/lib/rules/no-irregular-whitespace.js
Security findings (16)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in lib/rules/utils/ast-utils.js
Multiple obfuscation patterns in package/lib/rules/utils/ast-utils.js
Multiple obfuscation patterns in lib/rules/utils/char-source.js
Multiple obfuscation patterns in package/lib/rules/utils/char-source.js
Multiple obfuscation patterns in lib/linter/linter.js
Multiple obfuscation patterns in package/lib/linter/linter.js
Multiple obfuscation patterns in lib/rules/no-irregular-whitespace.js
Multiple obfuscation patterns in package/lib/rules/no-irregular-whitespace.js
Multiple obfuscation patterns in lib/rules/no-return-await.js
Multiple obfuscation patterns in package/lib/rules/no-return-await.js
Multiple obfuscation patterns in lib/rules/no-underscore-dangle.js
Multiple obfuscation patterns in package/lib/rules/no-underscore-dangle.js
Multiple obfuscation patterns in lib/rules/no-useless-return.js
Multiple obfuscation patterns in package/lib/rules/no-useless-return.js
Multiple obfuscation patterns in lib/types/rules.d.ts
Multiple obfuscation patterns in package/lib/types/rules.d.ts
Files in package (500)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/eslint