
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@rollup/pluginutils
Advanced tools
A set of utility functions commonly used by 🍣 Rollup plugins.
The plugin utils require an LTS Node version (v14.0.0+) and Rollup v1.20.0+.
Using npm:
npm install @rollup/pluginutils --save-dev
import utils from '@rollup/pluginutils';
//...
Available utility functions are listed below:
Note: Parameter names immediately followed by a ? indicate that the parameter is optional.
Adds an extension to a module ID if one does not exist.
Parameters: (filename: String, ext?: String)
Returns: String
import { addExtension } from '@rollup/pluginutils';
export default function myPlugin(options = {}) {
return {
resolveId(code, id) {
// only adds an extension if there isn't one already
id = addExtension(id); // `foo` -> `foo.js`, `foo.js` -> `foo.js`
id = addExtension(id, '.myext'); // `foo` -> `foo.myext`, `foo.js` -> `foo.js`
}
};
}
Attaches Scope objects to the relevant nodes of an AST. Each Scope object has a scope.contains(name) method that returns true if a given name is defined in the current scope or a parent scope.
Parameters: (ast: Node, propertyName?: String)
Returns: Object
See @rollup/plugin-inject or @rollup/plugin-commonjs for an example of usage.
import { attachScopes } from '@rollup/pluginutils';
import { walk } from 'estree-walker';
export default function myPlugin(options = {}) {
return {
transform(code) {
const ast = this.parse(code);
let scope = attachScopes(ast, 'scope');
walk(ast, {
enter(node) {
if (node.scope) scope = node.scope;
if (!scope.contains('foo')) {
// `foo` is not defined, so if we encounter it,
// we assume it's a global
}
},
leave(node) {
if (node.scope) scope = scope.parent;
}
});
}
};
}
Constructs a filter function which can be used to determine whether or not certain modules should be operated upon.
Parameters: (include?: <picomatch>, exclude?: <picomatch>, options?: Object)
Returns: (id: string | unknown) => boolean
include and excludeType: String | RegExp | Array[...String|RegExp]
A valid picomatch pattern, or array of patterns. If options.include is omitted or has zero length, filter will return true by default. Otherwise, an ID must match one or more of the picomatch patterns, and must not match any of the options.exclude patterns.
Note that picomatch patterns are very similar to minimatch patterns, and in most use cases, they are interchangeable. If you have more specific pattern matching needs, you can view this comparison table to learn more about where the libraries differ.
optionsresolveType: String | Boolean | null
Optionally resolves the patterns against a directory other than process.cwd(). If a String is specified, then the value will be used as the base directory. Relative paths will be resolved against process.cwd() first. If false, then the patterns will not be resolved against any directory. This can be useful if you want to create a filter for virtual module names.
import { createFilter } from '@rollup/pluginutils';
export default function myPlugin(options = {}) {
// assume that the myPlugin accepts options of `options.include` and `options.exclude`
var filter = createFilter(options.include, options.exclude, {
resolve: '/my/base/dir'
});
return {
transform(code, id) {
if (!filter(id)) return;
// proceed with the transformation...
}
};
}
Transforms objects into tree-shakable ES Module imports.
Parameters: (data: Object, options: DataToEsmOptions)
Returns: String
dataType: Object
An object to transform into an ES module.
optionsType: DataToEsmOptions
Note: Please see the TypeScript definition for complete documentation of these options
import { dataToEsm } from '@rollup/pluginutils';
const esModuleSource = dataToEsm(
{
custom: 'data',
to: ['treeshake']
},
{
compact: false,
indent: '\t',
preferConst: true,
objectShorthand: true,
namedExports: true,
includeArbitraryNames: false
}
);
/*
Outputs the string ES module source:
export const custom = 'data';
export const to = ['treeshake'];
export default { custom, to };
*/
Extracts the names of all assignment targets based upon specified patterns.
Parameters: (param: Node)
Returns: Array[...String]
paramType: Node
An acorn AST Node.
import { extractAssignedNames } from '@rollup/pluginutils';
import { walk } from 'estree-walker';
export default function myPlugin(options = {}) {
return {
transform(code) {
const ast = this.parse(code);
walk(ast, {
enter(node) {
if (node.type === 'VariableDeclarator') {
const declaredNames = extractAssignedNames(node.id);
// do something with the declared names
// e.g. for `const {x, y: z} = ...` => declaredNames = ['x', 'z']
}
}
});
}
};
}
Constructs a RegExp that matches the exact string specified. This is useful for plugin hook filters.
Parameters: (str: String | Array[...String], flags?: String)
Returns: RegExp
import { exactRegex } from '@rollup/pluginutils';
exactRegex('foobar'); // /^foobar$/
exactRegex(['foo', 'bar']); // /^(?:foo|bar)$/
exactRegex('foo(bar)', 'i'); // /^foo\(bar\)$/i
Constructs a bundle-safe identifier from a String.
Parameters: (str: String)
Returns: String
import { makeLegalIdentifier } from '@rollup/pluginutils';
makeLegalIdentifier('foo-bar'); // 'foo_bar'
makeLegalIdentifier('typeof'); // '_typeof'
Converts path separators to forward slash.
Parameters: (filename: String)
Returns: String
import { normalizePath } from '@rollup/pluginutils';
normalizePath('foo\\bar'); // 'foo/bar'
normalizePath('foo/bar'); // 'foo/bar'
Constructs a RegExp that matches a value that has the specified prefix. This is useful for plugin hook filters.
Parameters: (str: String | Array[...String], flags?: String)
Returns: RegExp
import { prefixRegex } from '@rollup/pluginutils';
prefixRegex('foobar'); // /^foobar/
prefixRegex(['foo', 'bar']); // /^(?:foo|bar)/
prefixRegex('foo(bar)', 'i'); // /^foo\(bar\)/i
Constructs a RegExp that matches a value that has the specified suffix. This is useful for plugin hook filters.
Parameters: (str: String | Array[...String], flags?: String)
Returns: RegExp
import { suffixRegex } from '@rollup/pluginutils';
suffixRegex('foobar'); // /foobar$/
suffixRegex(['foo', 'bar']); // /(?:foo|bar)$/
suffixRegex('foo(bar)', 'i'); // /foo\(bar\)$/i
Micromatch is a glob matching library that can be used to create filter functions similar to the createFilter utility in @rollup/pluginutils. It offers more extensive globbing capabilities but does not provide the other utilities found in @rollup/pluginutils.
Magic-string is a library for generating source maps and manipulating strings, which can be useful for plugin authors who need to modify code and track changes. While it doesn't offer the same utilities as @rollup/pluginutils, it is often used in conjunction with it for source map generation.
FAQs
A set of utility functions commonly used by Rollup plugins
The npm package @rollup/pluginutils receives a total of 19,426,179 weekly downloads. As such, @rollup/pluginutils popularity was classified as popular.
We found that @rollup/pluginutils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.