eslint-package-json weekly downloads statistics

eslint-package-json

Powerful ESLint rules for package.json

Lint and autofix your package.json files with ESLint, powered by @eslint/json.

This plugin catches real package.json mistakes (invalid names, bad version ranges, broken exports, misplaced @types/*, redundant files entries, and more) and fixes many of them automatically.

Install

Requires ESLint >=10.4, flat config, and ESM.

Usage

Add the recommended config to your eslint.config.js:

This lints every package.json in your project. To tweak individual rules, add them to the same config object:

If you prefer to wire it up manually instead of using a preset:

Configs

• recommended — Enables the rules that catch real, uncontroversial mistakes. • all — Enables every rule. Useful for discovering rules; not recommended for everyday use.

Rules

💼 Configurations enabled in.\ ✅ Set in the recommended configuration.\ 🔧 Automatically fixable by the --fix CLI option.\ 💡 Manually fixable by editor suggestions.

| Name | Description | 💼 | 🔧 | 💡 |

| consistent-name-casing | Enforce kebab-case for keys in scripts and bin objects. | | | | | consistent-path-prefix | Enforce consistent ./ prefix on local path fields. | ✅ | 🔧 | 💡 | | dependency-version-range | Enforce a consistent version range style for dependencies. | ✅ | | 💡 | | description-format | Enforce formatting of the description field. | | 🔧 | | | no-absolute-paths | Disallow absolute paths in path fields. | ✅ | | 💡 | | no-absolute-paths-in-scripts | Disallow absolute paths in scripts. | ✅ | | | | no-backslash-paths | Enforce forward slashes in path fields. | ✅ | 🔧 | 💡 | | no-core-module-dependencies | Disallow dependencies that shadow Node.js built-in modules. | ✅ | | 💡 | | no-deprecated-fields | Disallow fields and scripts that npm has deprecated. | ✅ | | | | no-dist-tag-dependencies | Disallow dist-tags as dependency specifiers. | ✅ | | | | no-duplicate-dependencies | Disallow a dependency listed in multiple dependency groups. | ✅ | 🔧 | 💡 | | no-empty-fields | Disallow empty fields. | ✅ | | 💡 | | no-exact-peer-dependencies | Disallow exact versions for peer dependencies. | | | 💡 | | no-exports-trailing-slash | Disallow trailing-slash folder mappings in exports/imports. | ✅ | | 💡 | | no-fallback-export-arrays | Discourage string-target fallback arrays in exports/imports. | ✅ | | | | no-git-dependencies | Disallow git URLs as dependency specifiers. | | | | | no-http-dependencies | Disallow HTTP URLs as dependency specifiers. | ✅ | | | | no-incompatible-peer-dependency-ranges | Disallow incompatible ranges for peer dependencies also listed as runtime dependencies. | ✅ | | 💡 | | no-install-scripts | Disallow install lifecycle scripts. | ✅ | | 💡 | | no-invalid-direct-overrides | Disallow npm overrides that conflict with direct dependencies. | ✅ | | 💡 | | no-local-dependencies | Disallow local filesystem paths as dependency specifiers. | | | | | no-manual-maintainers | Disallow a manually-set maintainers field. | ✅ | | 💡 | | no-missing-files | Disallow missing files referenced by package metadata. | | | | | no-nested-exports | Disallow exports in nested package.json files. | ✅ | | 💡 | | no-node-modules-bin-paths | Disallow direct node_modules/.bin paths in scripts. | ✅ | | 💡 | | no-orphan-script-hooks | Disallow pre/post script hooks without a corresponding script. | ✅ | | | | no-orphan-types | Disallow @types/* packages without a corresponding dependency. | ✅ | | 💡 | | no-overrides-in-published-package | Disallow overrides in packages that can be published. | ✅ | | 💡 | | no-package-manager-engines | Disallow package manager versions in the engines field. | ✅ | | 💡 | | no-pre-release-dependencies | Disallow pre-release versions as dependency specifiers. | | | | | no-redundant-files | Disallow redundant entries in the files field. | ✅ | 🔧 | | | no-redundant-repository-fields | Disallow bugs/homepage values that duplicate what npm infers from repository. | | 🔧 | | | no-restricted-dependencies | Disallow specific dependencies. | | | | | no-restricted-fields | Disallow specific fields. | | | 💡 | | no-self-dependency | Disallow a package depending on itself. | ✅ | | 💡 | | no-short-flags-in-scripts | Disallow short-form flags in scripts. | ✅ | 🔧 | | | no-typo-fields | Disallow misspelled package.json field names. | ✅ | | 💡 | | no-wildcard-dependencies | Disallow wildcard version ranges for dependencies. | ✅ | | | | no-workspace-protocol-in-published-package | Disallow workspace: dependency specifiers in packages that can be published. | ✅ | | | | peer-dependencies-as-dev-dependencies | Enforce peer dependencies to also be listed in devDependencies at a compatible version. | ✅ | | 💡 | | prefer-engines-range | Prefer open-ended >= ranges in the engines field. | ✅ | | 💡 | | prefer-exports | Prefer an exports-first package interface. | ✅ | | | | prefer-files-field | Require a files allowlist that covers published entry points. | ✅ | | | | prefer-https-urls | Prefer https:// URLs in metadata fields. | ✅ | 🔧 | | | prefer-provenance | Enforce npm provenance via publishConfig.provenance. | | | 💡 | | prefer-shorthand | Prefer the shorthand string form of fields where possible. | ✅ | 🔧 | | | prefer-side-effects-field | Recommend declaring the sideEffects field for packages. | ✅ | | 💡 | | prefer-type-module | Prefer the type field to be module. | ✅ | | 💡 | | require-bin-executable | Require bin files to be executable by their owner. | ✅ | | | | require-bin-shebang | Require bin files to start with a #!/usr/bin/env node shebang. | ✅ | | | | require-default-condition | Require a last default entry in exports/imports conditions objects. | ✅ | | | | require-engines | Require the engines.node field. | ✅ | | | | require-entry-point | Require an entry point field. | ✅ | | | | require-exports-root | Require a usable . root entry in the exports field. | | | | | require-fields | Require specific fields to be present, always or only for published packages. | ✅ | | | |…

Description from the npm listing.