
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@allex/rollup-plugin-node-resolve
Advanced tools
This plugin used to be called rollup-plugin-npm
Locate modules using the Node resolution algorithm, for using third party modules in node_modules
Based on forked from rollup-plugin-node-resolve, with some improvements and PR merges:
npm install --save-dev @allex/rollup-plugin-node-resolve@next
// rollup.config.js
import resolve from '@allex/rollup-plugin-node-resolve';
export default {
input: 'main.js',
output: {
file: 'bundle.js',
format: 'iife'
},
name: 'MyModule',
plugins: [
resolve({
// the fields to scan in a package.json to determine the entry point..
mainFields: ['module', 'main'], // Default: ['module', 'main']
// DEPRECATED: use `mainFields` instead
// use "module" field for ES6 module if possible
module: true, // Default: true
// DEPRECATED: use `mainFields` instead
// use "jsnext:main" if possible
// legacy field pointing to ES6 module in third-party libraries,
// deprecated in favor of "pkg.module":
// - see: https://github.com/rollup/rollup/wiki/pkg.module
jsnext: true, // Default: false
// DEPRECATED: use `mainFields` instead
// use "main" field or index.js, even if it's not an ES6 module
// (needs to be converted from CommonJS to ES6
// – see https://github.com/rollup/rollup-plugin-commonjs
main: true, // Default: true
// DEPRECATED: use `mainFields` instead
// some package.json files have a `browser` field which
// specifies alternative files to load for people bundling
// for the browser. If that's you, use this option, otherwise
// pkg.browser will be ignored
browser: true, // Default: false
// not all files you want to resolve are .js files
extensions: [ '.mjs', '.js', '.jsx', '.json' ], // Default: [ '.mjs', '.js', '.json', '.node' ]
// whether to prefer built-in modules (e.g. `fs`, `path`) or
// local ones with the same names
preferBuiltins: false, // Default: true
// Lock the module search in this path (like a chroot). Module defined
// outside this path will be marked as external
jail: '/my/jail/path', // Default: '/'
// Set to an array of strings and/or regexps to lock the module search
// to modules that match at least one entry. Modules not matching any
// entry will be marked as external
only: [ 'some_module', /^@some_scope\/.*$/ ], // Default: null
// If true, inspect resolved files to check that they are
// ES2015 modules
modulesOnly: true, // Default: false
// Any additional options that should be passed through
// to node-resolve
customResolveOptions: {
moduleDirectory: 'js_modules'
},
// Provide alias to overrides specifing modules.
alias: {
'readable-stream': require.resolve('rollup-plugin-node-builtins/src/es6/stream.js')
}
})
]
};
Since most packages in your node_modules folder are probably legacy CommonJS rather than JavaScript modules, you may need to use rollup-plugin-commonjs:
// rollup.config.js
import resolve from '@allex/rollup-plugin-node-resolve';
import commonjs from '@allex/rollup-plugin-commonjs';
export default {
input: 'main.js',
output: {
file: 'bundle.js',
format: 'iife'
},
name: 'MyModule',
plugins: [
resolve(),
commonjs()
]
};
MIT
FAQs
Bundle third-party dependencies in node_modules
We found that @allex/rollup-plugin-node-resolve demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.