Stops raw SQL before it reaches production, at lint time rather than at review.
ESLint & oxlint plugin for TypeORM: block raw SQL, prevent SQL injection, enforce transactions, guard multi-tenant queries, and apply enterprise backend governance.
npm i -D eslint-plugin-typeorm-enterprise Raw and string-built SQL scattered through a TypeORM codebase is both a security problem and a governance one: it walks around the query builder, opens the door to injection, and splits data access into as many patterns as there are developers.
This catches those patterns before review and before merge, while staying conservative enough not to fire on ordinary request and router code. It ships compiled JavaScript with bundled type definitions, so it works on any TypeScript version, or on none.
no-raw-query for static SQL; require-parameterized-query and no-interpolated-where for SQL built by string concatenation.
no-synchronize-true, which is auto-fixable, and no-unsafe-query-builder-delete for deletes and updates with no where clause.
no-entity-manager-query, require-transaction and prefer-transaction-for-multiple-writes keep data access inside the layer meant to hold it.
require-typed-query-result forces a row shape onto query() and getRawMany(); no-untyped-record-escape-hatch stops any and Record<string, any> standing in for one.
require-tenant-scope, with the tenant column names configurable, catches a query that forgot which tenant it was for.
prefer-exists-over-count steers an existence check away from counting every matching row.
Install
npm i -D eslint eslint-plugin-typeorm-enterpriseFlat config, ESLint 9+
const typeormEnterprise = require('eslint-plugin-typeorm-enterprise');
module.exports = [typeormEnterprise.configs.recommended];No. The package ships compiled JavaScript and bundled type definitions, so it runs on any TypeScript version or on a plain JavaScript project.
The rules are written to stay quiet on ordinary request and router code, and the shipped configs come in tiers. Start on recommended, move to strict once that is green, and add performance or multiTenant when they apply.
Yes, through the oxlint JS-plugin API, as well as ESLint 9 and 10 flat config.