Benchmark of six ESLint security plugins shows low F1 scores against self-authored fixtures

An author built a labelled corpus of 69 vulnerable code fixtures and tested six ESLint security plugins against it, using eslint-plugin-security 4.0.1, @microsoft/eslint-plugin-sdl 1.1.0, ESLint 10.8.1 and Node 24. The author's own tool, Interlace, scored 100%, while the other plugins ranged from 10.5% to 51.4% F1, with eslint-plugin-no-unsanitized showing 80% precision but low recall. The author acknowledges the fixtures reflect their own threat model, so low scores for plugins scoped to other surfaces such as browser DOM or Angular do not necessarily indicate poor quality. The benchmark is presented as a scope map and a regression gate rather than a ranking to select plugins, and the author has published the suite so others can reproduce the results.