
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
esbuild-plugin-eval
Advanced tools
This is an esbuild plugin that evaluates a module before importing it. It's useful in cases where you want to render static parts of your application at build time to prune runtime dependencies, such as pre-rendering html from JSX, or pre-calculating CSP header hashes.
This plugin will evaluate any imported module with .eval before the extension (example.eval.ts or example.eval.jsx and so on). It does this by bundling the module into a data url, dynamically importing it, and then re-exporting the results.
Install the dependency:
npm install esbuild-plugin-eval --save-dev
yarn add esbuild-plugin-eval -D
Add it to your esbuild plugins:
import { build } from 'esbuild'
import evalPlugin from 'esbuild-plugin-eval'
await build({
...yourConfig
plugins: [evalPlugin],
})
Example input:
// index.js (entry point)
export * from './schema.eval.js'
// schema.eval.js
import { z } from 'zod'
import { zodToJsonSchema } from 'zod-to-json-schema'
const mySchema = z
.object({
myString: z.string().min(5),
myUnion: z.union([z.number(), z.boolean()]),
})
.describe('My neat object schema')
export const jsonSchema = zodToJsonSchema(mySchema, 'mySchema')
Example after building:
// build/index.js
var jsonSchema = { "$ref": "#/definitions/mySchema", "definitions": { "mySchema": { "type": "object", "properties": { "myString": { "type": "string", "minLength": 5 }, "myUnion": { "type": ["number", "boolean"] } }, "required": ["myString", "myUnion"], "additionalProperties": false, "description": "My neat object schema" } }, "$schema": "http://json-schema.org/draft-07/schema#" };
In this case, we generate JSON schema at build time, and then serve it as a static file at runtime. The two dependecies used to create the schema, namely zod and zod-to-json-schema, are not included in the final bundle, thus reducing its size from 299KB to just 712 bytes.
A best effort is made to properly handle function exports, but keep in mind that all variables accessed from exported functions will need to be exported as well.
So this won't work:
let message = 'Hello, world!'
export default () => console.log(message)
But this will:
export let message = 'Hello, world!'
//^^^^
export default () => console.log(message)
Thanks to @jed for the original Deno implementation.
FAQs
A plugin that evaluates a module before importing it.
The npm package esbuild-plugin-eval receives a total of 1 weekly downloads. As such, esbuild-plugin-eval popularity was classified as not popular.
We found that esbuild-plugin-eval demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.