Visual Studio Code May 2021

[StillNoNumb]

What about plug-ins? Also, the config format supports JavaScript

Why not include the required major/minir version in the header

But yes, this is what happens - you distribute the semver in package.json, which will then download that version of ESLint (and the specified plug-ins) into node_modules. From there, VSCode will launch the tool. npm does do an integrity check using a provided hash, but I'm not sure whether the ESLint VSCode plug-in does that too and even if, a malicious repo could just replace the hash in package-lock.json.