
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@collagejs/importmap
Advanced tools
Provides parsing, validation and module resolution for import maps.
This is the home of @collagejs/importmap, an NPM package that validates import maps and resolves modules according to the MDN documentation.
npm install @collagejs/importmap
import { resolver, type ImportMap, type Resolver } from "@collagejs/importmap";
const myMap: ImportMap = obtainMyImportMapSomehow();
const imResolver = resolver(myMap);
importer parameter is not given, resolution cannot use the scopes rules of the import map:
const resolvedUrl = imResolver.resolve('@my/bare-specifier', '/legacy');
// ------------------------------------^ module specifier ---^ importer
Since v0.2.0
The package also exports an IIFE version that creates the global object ImportMap. This object provides access to the resolver() and validate() functions:
<head>
<script type="text/javascript" src="https://cdn.jsdelivr.net/@collagejs/importmap@latest/dist/index.iife.js"></script>
<script type="text/javascript">
console.log('ImportMap object:', ImportMap);
</script>
</head>
Validation happens in 2 places: When creating a resolver, and when explicitly validating an import map:
import { resolver, validate, type ValidationResult } from "@collagejs/importmap";
// A Resolver object validates an import map upon construction:
const imResolver = resolver(myImportMap);
console.log('My import map is %s.', imResolver.valid ? 'valid' : 'invalid');
// Directly validating an import map:
const validationResult = validate(myImportMap); // of type ValidationResult
if (!validationResult.valid) {
let msg = `The import map failed validation and has reported ${validationResult.errors.length} error(s):`;
for (const e of validationResult.errors) {
msg += `\n ❌ ${e}`
}
console.warn(msg);
}
⚠️ IMPORTANT: A resolver that holds an invalid import map will throw an error if module resolution is attempted. Always check for
Resolver.valid(orResolver.validationResult.valid).
This package adheres as best it can to the expected module resolution mechanism, but for the sake of practicality, it does a couple of things users might not expect. Read this section to fully understand the return value of Resolver.resolve().
If the provided module specifier matches (either in scopes or global imports), then the value in the import map entry that matched will be returned. So far, this is standard.
In the cases where no match is found and the provided module specifier was:
./ or ../)/)Then the module identifier is returned. A special case happens for relative URL's when an importer that is a URL is provided. In this case, the relative URL represented by the module identifier is resolved against the importer and the result is returned.
Example:
const resolved = resolver.resolve('../my/module', '/base-app');
console.log(resolved);
/*
------ OUTPUT ------
/my/module
*/
Since the relative URL has consumed (popped) one URL segment, the importer value has provided that segment and the end result is an absolute URL.
@jspm/import-map: NPM Provides import map building via code and module resolution. Does not provide validation.FAQs
Provides parsing, validation and module resolution for import maps.
We found that @collagejs/importmap demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.