This is definitely a compatibility bug in eslint-plugin-security v1, specifically in the detect-child-process rule. The error pops up because the rule's code tries to access node.property.type without first checking if node.property exists—your Mongoose find().exec() chain is triggering this unhandled edge case in the plugin's AST parsing logic.

Here are actionable fixes to resolve this:

1. Disable the problematic rule temporarily #

Add this to your .eslintrc.js to turn off the broken rule while keeping other security checks intact:

module.exports = {
  // ... your existing configuration
  rules: {
    'security/detect-child-process': 'off'
  }
};

This will get ESLint running normally right away.

2. Update eslint-plugin-security to a patched version #

Run this command to update the plugin to the latest patch release in the v1 branch (which may have fixed this AST parsing bug):

npm update eslint-plugin-security --save-dev

If you're already on the latest v1 version, this bug has been reported in the plugin's issue tracker before—newer patch releases often address these kinds of parsing edge cases.

3. Downgrade to an older stable version #

If updating doesn't resolve the issue, try installing an earlier version of the plugin that doesn't have this bug. For example:

npm install eslint-plugin-security@1.3.0 --save-dev

Older releases in the v1 line are less likely to have this specific AST handling flaw.

4. Quick hack (advanced, temporary) #

If you need a immediate fix without changing versions, you can add a null check directly to the plugin's rule file (note: this will be overwritten on any npm install):

Open /app/api/node_modules/eslint-plugin-security/rules/detect-child-process.js
Find line 34 and modify it to:

if (node.property && node.property.type === 'Identifier' && forbiddenChildProcessMethods.includes(node.property.name)) {

Your Mongoose code (async list() { return this.LogModel.find().exec(); }) is totally fine—this is 100% a plugin-side bug, not an issue with your implementation.

内容的提问来源于stack exchange，提问作者Narges Pms