
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@eggjs/utils
Advanced tools
Utils for all egg projects.
npm i @eggjs/utils
getPlugins(options)getLoadUnits(options)getConfig(options)getFrameworkPath(options)setBundleModuleLoader(loader)Register a module loader hook for bundled Egg apps. The hook runs before the
normal importModule() resolution path.
filepath argument passed to importModule() after POSIX separator
normalization, or a virtual specifier. It does not receive the resolved
absolute file path from importResolve(). Return undefined to fall back to
the normal import path.The bundle loader is stored on globalThis, so bundled and external copies of
@eggjs/utils share the same loader. Non-undefined results follow the same
default export unwrapping rules as importModule(), including
importDefaultOnly.
importModule() resolves a module through the following hooks, in order. The
first one that produces a value wins; otherwise it falls back to the native
import() / require() path:
globalThis.__EGG_BUNDLE_MODULE_LOADER__ — set via
setBundleModuleLoader(). Looks up a module already inlined into the bundle
(typically a static bundle map emitted by egg-bundler). Runs before on-disk
resolution and receives the POSIX-normalized importModule() filepath or a
virtual specifier. Return undefined to fall through.setSnapshotModuleLoader(). This is a
module-local hook (not a globalThis global) used by the V8 snapshot entry
generator to serve pre-bundled modules synchronously, keyed by the resolved
path. Once registered it handles every load that reaches it, so the importer
below is not consulted while it is active.globalThis.__EGG_MODULE_IMPORTER__ — an async (or sync, since the value
is awaited) importer that receives the resolved file path (the
importResolve() result, with OS-native separators — not normalized). When
set, and the two hooks above did not resolve the module, it replaces the
native await import(filePath).The bundle loader and importer globals are typed in @eggjs/typings
(BundleModuleLoader / ModuleImporter); import @eggjs/typings/global to pick
up the declare global augmentation. These hooks are the contract that
egg-bundler's generated entry relies on. @eggjs/core's ManifestLoaderFS
consults __EGG_BUNDLE_MODULE_LOADER__ directly; its importer/native fallback is
reached through @eggjs/loader-fs, which calls back into importModule(). The
tegg loader (LoaderUtil.loadFile) consults both globals directly, passing the
loader filepath with separators normalized to POSIX.
__EGG_MODULE_IMPORTER__ has two main uses:
ctx.getEggObject(ClassRef) fails with
"can not get proto").import() throws. The snapshot entry
installs a synchronous require()-based importer (createRequire() over the
bundle output dir); require() can load ESM on Node >= 22, so modules resolve
without dynamic import.Made with contributors-img.
FAQs
Utils for all egg projects
The npm package @eggjs/utils receives a total of 8,919 weekly downloads. As such, @eggjs/utils popularity was classified as popular.
We found that @eggjs/utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.