
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@fictiv/eslint-plugin-import
Advanced tools
This plugin intends to support linting of ES2015+ (ES6+) import/export syntax, and prevent issues with misspelling of file paths and import names. All the goodness that the ES2015+ static module syntax intends to provide, marked up in your editor.
IF YOU ARE USING THIS WITH SUBLIME: see the bottom section for important info.
no-unresolved)named)default)namespace)no-restricted-paths)no-absolute-path)require() calls with expressions (no-dynamic-require)no-internal-modules)no-webpack-loader-syntax)no-self-import)no-cycle)no-useless-path-segments)no-relative-parent-imports)no-unused-modules)export)no-named-as-default)no-named-as-default-member)@deprecated documentation tag (no-deprecated)no-extraneous-dependencies)var or let. (no-mutable-exports)no-unused-modules)script vs. module) (unambiguous)require calls and module.exports or exports.*. (no-commonjs)require and define calls. (no-amd)no-nodejs-modules)first)exports-last)no-duplicates)no-namespace)extensions)order)newline-after-import)prefer-default-export)max-dependencies)no-unassigned-import)no-named-default)no-default-export)no-named-export)no-anonymous-default-export)group-exports)dynamic-import-chunkname)npm install eslint-plugin-import -g
or if you manage ESLint as a dev dependency:
# inside your project's working tree
npm install eslint-plugin-import --save-dev
All rules are off by default. However, you may configure them manually
in your .eslintrc.(yml|json|js), or extend one of the canned configs:
---
extends:
- eslint:recommended
- plugin:import/errors
- plugin:import/warnings
# or configure manually:
plugins:
- import
rules:
import/no-unresolved: [2, {commonjs: true, amd: true}]
import/named: 2
import/namespace: 2
import/default: 2
import/export: 2
# etc...
You may use the following shortcut or assemble your own config using the granular settings described below.
Make sure you have installed @typescript-eslint/parser which is used in the following configuration. Unfortunately NPM does not allow to list optional peer dependencies.
extends:
- eslint:recommended
- plugin:import/errors
- plugin:import/warnings
- plugin:import/typescript # this line does the trick
With the advent of module bundlers and the current state of modules and module
syntax specs, it's not always obvious where import x from 'module' should look
to find the file behind module.
Up through v0.10ish, this plugin has directly used substack's resolve plugin,
which implements Node's import behavior. This works pretty well in most cases.
However, webpack allows a number of things in import module source strings that
Node does not, such as loaders (import 'file!./whatever') and a number of
aliasing schemes, such as externals: mapping a module id to a global name at
runtime (allowing some modules to be included more traditionally via script tags).
In the interest of supporting both of these, v0.11 introduces resolvers.
Currently Node and webpack resolution have been implemented, but the resolvers are just npm packages, so third party packages are supported (and encouraged!).
You can reference resolvers in several ways (in order of precedence):
eslint-import-resolver name, like eslint-import-resolver-foo:# .eslintrc.yml
settings:
# uses 'eslint-import-resolver-foo':
import/resolver: foo
// .eslintrc.js
module.exports = {
settings: {
'import/resolver': {
foo: { someConfig: value }
}
}
}
my-awesome-npm-module:# .eslintrc.yml
settings:
import/resolver: 'my-awesome-npm-module'
// .eslintrc.js
module.exports = {
settings: {
'import/resolver': {
'my-awesome-npm-module': { someConfig: value }
}
}
}
computed property name:// .eslintrc.js
module.exports = {
settings: {
'import/resolver': {
[path.resolve('../../../my-resolver')]: { someConfig: value }
}
}
}
Relative paths will be resolved relative to the source's nearest package.json or
the process's current working directory if no package.json is found.
If you are interesting in writing a resolver, see the spec for more details.
You may set the following settings in your .eslintrc:
import/extensionsA list of file extensions that will be parsed as modules and inspected for
exports.
This defaults to ['.js'], unless you are using the react shared config,
in which case it is specified as ['.js', '.jsx'].
"settings": {
"import/extensions": [
".js",
".jsx"
]
}
If you require more granular extension definitions, you can use:
"settings": {
"import/resolver": {
"node": {
"extensions": [
".js",
".jsx"
]
}
}
}
Note that this is different from (and likely a subset of) any import/resolver
extensions settings, which may include .json, .coffee, etc. which will still
factor into the no-unresolved rule.
Also, the following import/ignore patterns will overrule this list.
import/ignoreA list of regex strings that, if matched by a path, will
not report the matching module if no exports are found.
In practice, this means rules other than no-unresolved will not report on any
imports with (absolute filesystem) paths matching this pattern.
no-unresolved has its own ignore setting.
settings:
import/ignore:
- \.coffee$ # fraught with parse errors
- \.(scss|less|css)$ # can't parse unprocessed CSS modules, either
import/core-modulesAn array of additional modules to consider as "core" modules--modules that should
be considered resolved but have no path on the filesystem. Your resolver may
already define some of these (for example, the Node resolver knows about fs and
path), so you need not redefine those.
For example, Electron exposes an electron module:
import 'electron' // without extra config, will be flagged as unresolved!
that would otherwise be unresolved. To avoid this, you may provide electron as a
core module:
# .eslintrc.yml
settings:
import/core-modules: [ electron ]
In Electron's specific case, there is a shared config named electron
that specifies this for you.
Contribution of more such shared configs for other platforms are welcome!
import/external-module-foldersAn array of folders. Resolved modules only from those folders will be considered as "external". By default - ["node_modules"]. Makes sense if you have configured your path or webpack to handle your internal paths differently and want to considered modules from some folders, for example bower_components or jspm_modules, as "external".
import/parsersA map from parsers to file extension arrays. If a file extension is matched, the dependency parser will require and use the map key as the parser instead of the configured ESLint parser. This is useful if you're inter-op-ing with TypeScript directly using webpack, for example:
# .eslintrc.yml
settings:
import/parsers:
@typescript-eslint/parser: [ .ts, .tsx ]
In this case, @typescript-eslint/parser
must be installed and require-able from the running eslint module's location
(i.e., install it as a peer of ESLint).
This is currently only tested with @typescript-eslint/parser (and its predecessor,
typescript-eslint-parser) but should theoretically work with any moderately
ESTree-compliant parser.
It's difficult to say how well various plugin features will be supported, too,
depending on how far down the rabbit hole goes. Submit an issue if you find strange
behavior beyond here, but steel your heart against the likely outcome of closing
with wontfix.
import/resolverSee resolvers.
import/cacheSettings for cache behavior. Memoization is used at various levels to avoid the copious amount of fs.statSync/module parse calls required to correctly report errors.
For normal eslint console runs, the cache lifetime is irrelevant, as we can strongly assume that files should not be changing during the lifetime of the linter process (and thus, the cache in memory)
For long-lasting processes, like eslint_d or eslint-loader, however, it's important that there be some notion of staleness.
If you never use eslint_d or eslint-loader, you may set the cache lifetime to Infinity and everything should be fine:
# .eslintrc.yml
settings:
import/cache:
lifetime: ∞ # or Infinity
Otherwise, set some integer, and cache entries will be evicted after that many seconds have elapsed:
# .eslintrc.yml
settings:
import/cache:
lifetime: 5 # 30 is the default
SublimeLinter-eslint introduced a change to support .eslintignore files
which altered the way file paths are passed to ESLint when linting during editing.
This change sends a relative path instead of the absolute path to the file (as ESLint
normally provides), which can make it impossible for this plugin to resolve dependencies
on the filesystem.
This workaround should no longer be necessary with the release of ESLint 2.0, when
.eslintignore will be updated to work more like a .gitignore, which should
support proper ignoring of absolute paths via --stdin-filename.
In the meantime, see roadhump/SublimeLinter-eslint#58
for more details and discussion, but essentially, you may find you need to add the following
SublimeLinter config to your Sublime project file:
{
"folders":
[
{
"path": "code"
}
],
"SublimeLinter":
{
"linters":
{
"eslint":
{
"chdir": "${project}/code"
}
}
}
}
Note that ${project}/code matches the code provided at folders[0].path.
The purpose of the chdir setting, in this case, is to set the working directory
from which ESLint is executed to be the same as the directory on which SublimeLinter-eslint
bases the relative path it provides.
See the SublimeLinter docs on chdir
for more information, in case this does not work with your project.
If you are not using .eslintignore, or don't have a Sublime project file, you can also
do the following via a .sublimelinterrc file in some ancestor directory of your
code:
{
"linters": {
"eslint": {
"args": ["--stdin-filename", "@"]
}
}
}
I also found that I needed to set rc_search_limit to null, which removes the file
hierarchy search limit when looking up the directory tree for .sublimelinterrc:
In Package Settings / SublimeLinter / User Settings:
{
"user": {
"rc_search_limit": null
}
}
I believe this defaults to 3, so you may not need to alter it depending on your
project folder max depth.
FAQs
Import with sanity.
We found that @fictiv/eslint-plugin-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.