no-proto

object.__proto__ is a getter and setter that objects inherit from Object.prototype. An object made with Object.create(null) doesn't have it, so on that object __proto__ is an ordinary property and reading it returns undefined. Object.getPrototypeOf() and Object.setPrototypeOf() work on every object.

Using __proto__ as a key in an object literal sets the new object's prototype, and that isn't reported.

Configure#

Off by default. To turn it on:

[lint.rules]
"no-proto" = "error" # or "warn"

Examples#

const parent = user.__proto__;
user["__proto__"] = admin;

const parent = Object.getPrototypeOf(user);
Object.setPrototypeOf(user, admin);

const guest = { __proto__: user, name: "guest" };