eslint-plugin-react-hooks
ESLint rules for React Hooks
100
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
react-bot
Keywords
eslinteslint-plugineslintpluginreact
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (babel/core, hermes-parser, zod, etc.) are all established packages supporting the React Compiler integration added in v6.0.0. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Major version (6.0.0) bundles React Compiler integration, explaining the 34.6x size increase. Legitimate feature addition, not payload injection. | ai | |
| source-diff | net-exec-file:cjs/eslint-plugin-react-hooks.production.js | AI (source-diff): Bundled CJS production build; 'crypto' is Node built-in, no actual network calls present. Pattern is a false positive on minified ESLint plugin bundle from official Meta/React repo. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): eslint-plugin-react-hooks is the official React ESLint plugin from Facebook/Meta. Version 0.0.0 is a known placeholder/canary pattern for this package, not a malicious indicator. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Used in the bundled CJS production file; static analyzer cannot trace imports through the bundle. Legitimate runtime dependency. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): react-bot is Meta's official publishing bot for React packages; the transition from individual maintainers to react-bot is a documented organizational practice, not a hijack. | ai | |
| source-diff | obfuscated-file:cjs/eslint-plugin-react-hooks.production.js | AI (source-diff): File is a standard minified production CJS build artifact with MIT license header and readable logic; long lines are from minification, not obfuscation. Normal for React's build pipeline. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): Used in the bundled CJS production file for compiler integration. Legitimate runtime dependency. | ai | |
| phantom-deps | phantom-dep:@babel/parser | AI (phantom-deps): Used in the bundled CJS production file for compiler integration. Legitimate runtime dependency. | ai | |
| phantom-deps | phantom-dep:hermes-parser | AI (phantom-deps): Used in the bundled CJS production file for Hermes JS parsing. Legitimate runtime dependency. | ai | |
| phantom-deps | phantom-dep:zod-validation-error | AI (phantom-deps): Used in the bundled CJS production file alongside zod for config validation. Legitimate runtime dependency. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-proposal-private-methods | AI (phantom-deps): Used in the bundled CJS production file for Babel transformation. Legitimate runtime dependency. | ai | |
| dependencies | unvetted-dep:zod-validation-error | AI (dependencies): zod-validation-error is a standard companion utility to zod; its inclusion alongside zod in this official React package is benign. | ai | |
| dependencies | unvetted-dep:zod | AI (dependencies): zod is a well-known, widely-adopted schema validation library; its use in eslint-plugin-react-hooks for React Compiler integration is legitimate and low-risk. | ai | |
| provenance | publisher-changed | AI (provenance): eps1lon is a known React core team member; publisher transition from gnoff to eps1lon is a legitimate React team change, not a compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): eps1lon and react-bot are legitimate React team accounts; addition reflects normal React team roster management. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of trueadm and lunaruan reflects normal React team roster changes; no evidence of malicious takeover. | ai | |
| provenance | no-provenance | AI (provenance): react-bot publishes official React packages without Sigstore provenance; this is consistent across their releases and not a risk signal. | ai | |
| dependencies | unvetted-dep:hermes-parser | AI (dependencies): hermes-parser is Meta's own JS parser, appropriate for a Meta-published React ESLint plugin. Not a risk signal for this package. | ai |
Versions (showing 100 of 272)
Showing 100 of 272
Next page →
v7.1.0-canary-80cb7a99-20251211
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.0-canary-24d8716e-20260123
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0-canary-ead92181-20251010
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0-experimental-d2908752-20260119
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0-experimental-bb8a76c6-20260115
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.