Registry / devops / eslint-plugin-lockfile

eslint-plugin-lockfile

library1.1.0jsnpmunverified

An ESLint plugin for linting npm ecosystem lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock, vlt-lock.json). Version 1.1.0 requires ESLint ^9.39.2 and Node >=22.21. Provides 6 rules including integrity verification, registry enforcement, and lockfile version/format controls. Maintained by ljharb. Differentiators: supports 5 package managers, supply-chain attack protection via integrity checks, and both flat and legacy configs.

devops testing

npm install eslint-plugin-lockfile

github ↗package ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-LOCK

eslint-plugin-lockfile

devopsjavascriptv1.1.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

lockfile

✓ import lockfile from 'eslint-plugin-lockfile'

✗ const lockfile = require('eslint-plugin-lockfile')

ESM-only default export; CommonJS require is not supported

lockfile.configs.recommended

✓ import lockfile from 'eslint-plugin-lockfile'; ... lockfile.configs.recommended

✗ import { configs } from 'eslint-plugin-lockfile'

configs is not a named export; access via default import

rules

✓ import lockfile from 'eslint-plugin-lockfile'; lockfile.rules['lockfile/flavor']

✗ import { rules } from 'eslint-plugin-lockfile'

rules are not named exports; access via plugin object

Shows full flat config setup with all rules enabled and linting a lockfile.

// Install npm install eslint-plugin-lockfile --save-dev // eslint.config.js import lockfile from 'eslint-plugin-lockfile'; export default [ lockfile.configs.recommended, { files: ['**/package-lock.json', '**/yarn.lock', '**/pnpm-lock.yaml', '**/bun.lock', '**/bun.lockb', '**/vlt-lock.json'], plugins: { lockfile }, rules: { 'lockfile/flavor': ['error', 'npm'], 'lockfile/version': 'error', 'lockfile/integrity': 'error', 'lockfile/registry': 'error', 'lockfile/non-registry-specifiers': 'warn', 'lockfile/binary-conflicts': 'error', }, }, ]; // Lint lockfiles npx eslint '**/package-lock.json'

Debug

Known issues

breakingESLint 8 legacy config is available but deprecated; future versions may drop support.

fix

Migrate to flat config (ESLint 9+). Use 'plugin:lockfile/recommended-legacy' only if stuck on ESLint 8.

affects: >=1.0.0

deprecatedThe 'reccommended-legacy' config is deprecated and will be removed in a future major version.

fix

Use 'lockfile.configs.recommended' with flat config instead.

affects: >=1.0.0

gotchaRule 'flavor' with a single string argument must be an array of flavors (e.g., ['npm', 'yarn']), not a single string.

fix

Use ['error', ['npm']] for a single flavor, not ['error', 'npm'].

affects: >=1.0.0

gotchaLockfile parsing may fail silently if the lockfile format is unsupported or malformed; errors are not always surfaced.

fix

Ensure lockfiles are valid for the detected package manager. Test with a simple lint run first.

affects: >=1.0.0

gotchaIntegrity rule may produce false positives if packages are from custom registries without standard integrity fields.

fix

Add exclusions for known non-standard packages or disable integrity if using private registries without hashes.

affects: >=1.0.0

deprecatedNode.js versions below ^22.21 || ^24.11 || >=25.2 are not supported.

fix

Upgrade Node.js to >=22.21, >=24.11, or >=25.2.

affects: >=1.0.0

Errors

Common errors & fixes

Error: Failed to load plugin 'lockfile': Cannot find module 'eslint-plugin-lockfile'

Plugin not installed or not in node_modules

fix

Run 'npm install eslint-plugin-lockfile --save-dev'

TypeError: lockfile.configs is undefined

Plugin loaded with require() but default export is not accessed properly

fix

Use import statement: 'import lockfile from "eslint-plugin-lockfile"'

ESLint: Error while loading rule 'lockfile/flavor': Rule options must be an array

Rule configuration is not properly formatted as an array

fix

Configure as ['error', 'npm'] or ['error', ['npm', 'yarn']]

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

eslintrequiredPeer dependency: required to load and run the plugin; must be version ^9.39.2

Agent activity

6 hits · last 30 days

node

Resources

githubhttps://github.com/ljharb/lockfile-tools ↗

packagehttps://www.npmjs.com/package/eslint-plugin-lockfile ↗