Skip to: Full Results | Category Breakdown | The Leaderboard | Methodology

TL;DR

I built a benchmark suite with 40 vulnerable code patterns across 14 CWE categories and 38 verified-safe patterns. Then I ran 17 ESLint plugins against them — every major security, quality, and framework plugin in the ecosystem.

One plugin achieved a perfect score. Most others detected under 50% of patterns.

† eslint-plugin-security crashes on ESLint 9.39.2 with TypeError: context.getScope is not a function, so the bench records 0 detections on the standard test environment. On ESLint 8.57.0 it detects 11/40 (recall 27.5%) but with an equal number of false positives (a 1:1 TP:FP ratio).

The incumbent security plugin — eslint-plugin-security, with 1.5M+ weekly downloads — detects zero vulnerabilities on modern ESLint because it hasn't been updated for the flat-config API.

Why This Matters

Most Node.js teams rely on a security linter they've never benchmarked. They install eslint-plugin-security or enable SonarJS security rules and assume they're covered.

They're not.

The data shows a massive detection gap across the entire ecosystem. Plugins that claim security coverage miss 60–100% of standard vulnerability patterns. And some of the highest-downloaded plugins aren't security tools at all — they detected zero issues from our suite.

This isn't theoretical. These are OWASP Top 10 patterns that ship to production every day.

The Benchmark Suite

Test Environment

Vulnerable Patterns (40 cases, 14 CWE categories)

Safe Patterns (38 cases)

These are correctly-implemented secure patterns that should NOT trigger warnings:

• Parameterized SQL queries (Prisma, TypeORM, pg)
• execFile with validated arguments
• path.resolve with startsWith validation
• Environment variables for credentials
• JWT with explicit algorithm restriction
• DOMPurify sanitization
• Allowlist validation before object access
• crypto.randomBytes for tokens
• crypto.timingSafeEqual for comparisons
• URL allowlists for SSRF prevention

Any warnings on these patterns are false positives — noise that creates alert fatigue and trains developers to ignore real issues.

The Results

The Leaderboard

Plugin download counts cited throughout this article are weekly figures snapshotted on 2026-02-08 from npm-stat.com.

Note: eslint-plugin-jsdoc (38 TP / 37 FP / F1=66.1%) was excluded from the leaderboard. Its detections are incidental — it flags every function missing JSDoc, not security issues. A 97.4% false positive rate is unusable for security.

Visual Detection Rates

Vulnerable Code Detections (out of 40 patterns):

Interlace Ecosystem:       ████████████████████████████████████████  40 (100%)
eslint-plugin-unicorn:     ██████████████████████░░░░░░░░░░░░░░░░░░  22 (55%)
eslint-plugin-sonarjs:     ██████████████░░░░░░░░░░░░░░░░░░░░░░░░░░  14 (35%)
@microsoft/eslint-plugin:  ████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░   4 (10%)
eslint-plugin-security:    ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░   0 (0%)

The plugins behind "Interlace Ecosystem"

The "Interlace Ecosystem" row in the leaderboard is the combined output of 10 ESLint plugins running together against the same fixture suite — 201 rules in total:

eslint-plugin-secure-coding · eslint-plugin-node-security · eslint-plugin-browser-security · eslint-plugin-pg · eslint-plugin-jwt · eslint-plugin-mongodb-security · eslint-plugin-vercel-ai-security · eslint-plugin-lambda-security · eslint-plugin-express-security · eslint-plugin-nestjs-security

Per-plugin rule counts and focus areas are in Specialization vs. one-size-fits-all below.

The Security Plugins: Deep Dive

eslint-plugin-security (1.5M+ downloads) — BROKEN

F1 Score: 0% | Zero detections

The most widely-installed ESLint security plugin detected nothing. It crashes on ESLint 9 with:

TypeError: context.getScope is not a function
Rule: "security/detect-child-process"

This is due to the deprecated context.getScope() API removed in ESLint 9. The plugin hasn't been updated since 2024. If you're using ESLint 9 with flat config, this plugin provides zero security coverage.

📖 Deep dive: eslint-plugin-security Is Abandoned

eslint-plugin-sonarjs (3M+ downloads) — 35% Recall

F1 Score: 47.5% | 14 detected, 26 missed, 5 false positives

SonarJS found issues across a few categories but missed the majority:

Despite having 269 rules (the most of any plugin tested), SonarJS missed 65% of vulnerabilities. Many of its rules target code quality, not security.

📖 Deep dive: SonarJS vs Interlace: 269 Rules, 65% Missed

@microsoft/eslint-plugin-sdl — 10% Recall

F1 Score: 17.8% | 4 detected, 36 missed, 1 false positive

Microsoft's SDL (Security Development Lifecycle) plugin found XSS via innerHTML/document.write and eval patterns, but missed everything else. Its 17 rules focus narrowly on browser-side injection.

📖 Deep dive: Microsoft SDL vs Interlace: Enterprise Security Benchmark

eslint-plugin-no-secrets — Narrow But Precise

F1 Score: 9.5% | 2 detected, 0 false positives

Only 2 rules, but they do their job — detecting hardcoded secrets with zero false positives. Good as a supplement, but not a security strategy.

eslint-plugin-no-unsanitized (Mozilla) — DOM XSS Only

F1 Score: 9.3% | 2 detected, 1 false positive

Detects innerHTML and insertAdjacentHTML DOM sinks. Cannot recognize DOMPurify sanitization (1 FP). Useful for browser projects but covers only 2 of 14 categories.

The Non-Security Plugins: Confirmed Gaps

These widely-installed plugins are not security tools, confirmed by zero detections:

These are excellent tools for their intended purpose. But if your security posture relies on them, you have zero coverage.

Category-by-Category Breakdown

Specialization vs. one-size-fits-all

The reason Interlace achieves 100% coverage is specialization. Instead of one monolithic plugin trying to cover everything, the ecosystem uses 10 purpose-built plugins:

Crypto rules (weak algorithms, insecure randomness) were consolidated into eslint-plugin-node-security on 2026-05-10. The previously separate eslint-plugin-crypto package is deprecated and should not be installed.

Each plugin is maintained by domain experts and updated independently. A JWT vulnerability doesn't require updating the SQL injection rules.

What This Means For Your Team

The Math

If your codebase has 100 potentially vulnerable patterns:

The False Positive Tax

False positives create alert fatigue — developers learn to ignore security warnings:

Methodology

Fixture Design

All fixtures are:

• Realistic: Patterns from actual production codebases, not contrived examples
• Annotated: Each pattern includes its CWE, expected severity, and detection requirement
• Reproducible: Published in the open-source benchmark suite

Metrics

Reproducibility

git clone https://github.com/ofri-peretz/eslint-benchmark-suite
cd eslint-benchmark-suite
npm install
npm run benchmark:fn-fp

Every claim in this article can be independently verified.

Migrate in 60 Seconds

npm install -D eslint-plugin-secure-coding eslint-plugin-node-security \
  eslint-plugin-browser-security \
  eslint-plugin-pg eslint-plugin-jwt eslint-plugin-mongodb-security

// eslint.config.js
import secureCoding from "eslint-plugin-secure-coding";
import nodeSecurity from "eslint-plugin-node-security";
import browserSecurity from "eslint-plugin-browser-security";

export default [
  secureCoding.configs.recommended,
  nodeSecurity.configs.recommended,
  browserSecurity.configs.recommended,
];

Run ESLint. See what you've been missing.

Related deep dives in this series

This article is the ecosystem overview. For detailed per-plugin comparisons, see:

• SonarJS vs Interlace: 269 Rules Still Miss 65% of Vulnerabilities
• Microsoft SDL vs Interlace: Enterprise Security Benchmark
• eslint-plugin-security Is Unmaintained — Here's What to Use Instead

Explore the Full Ecosystem

201 security rules. 10 specialized plugins. 100% OWASP Top 10 coverage.

The Interlace ESLint Ecosystem provides comprehensive security static analysis for modern Node.js applications.

📖 Documentation | ⭐ GitHub | 📦 NPM

Build Securely.

I'm Ofri Peretz, a Security Engineering Leader and the architect of the Interlace Ecosystem. I build static analysis standards that automate security and performance for Node.js fleets at scale.

ofriperetz.dev | LinkedIn | GitHub