The False Positive Tax: a 1:1 TP:FP analysis of eslint-plugin-security

A benchmark of six ESLint security plugins tested 40 vulnerable and 38 safe code patterns across 14 security categories.

eslint-plugin-security caught only 11 of 40 vulnerabilities and flagged 11 safe patterns, resulting in a 1:1 true-positive to false-positive ratio.

The Interlace ecosystem performed best, detecting all 40 vulnerabilities with zero false positives.

The findings highlight the tradeoff between recall and precision in security linters: missed issues create false safety, while false alarms drive alert fatigue.