
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
eslint-plugin-import-extensions
Advanced tools
TypeScript [doesn't transform extensions](https://github.com/microsoft/TypeScript/issues/16577) and [doesn't enforce file extensions](https://github.com/microsoft/TypeScript/issues/42813).
TypeScript doesn't transform extensions and doesn't enforce file extensions.
This is a simple eslint plugin that ensures that relative imports and exports have extensions as desired (e.g. .js
, .ts
, .cjs
, etc.). It also ensures that index files are explicitly imported.
This is a fork of eslint-plugin-require-extensions.
Credit for the original implementation goes to johnrees. ❤️
npm install --save-dev eslint-plugin-require-extensions
.eslintrc
{
"extends": ["plugin:import-extensions/recommended"],
"plugins": ["import-extensions"]
}
The default expectedExtensions
option is ['js']
, but you may override it and extensions will be used in priority order (most important first).
{
"rules": {
"import-extensions/require-extensions": ["error", { "expectedExtensions": ["ts"] }],
"import-extensions/require-index": ["error", { "expectedExtensions": ["ts"] }]
}
}
// source.js
import Target from './target';
eslint .
source.js
1:1 error Relative imports and exports must end with .js import-extensions/require-extensions
eslint --fix .
// source.js
import Target from './target.js';
FAQs
TypeScript [doesn't transform extensions](https://github.com/microsoft/TypeScript/issues/16577) and [doesn't enforce file extensions](https://github.com/microsoft/TypeScript/issues/42813).
The npm package eslint-plugin-import-extensions receives a total of 515 weekly downloads. As such, eslint-plugin-import-extensions popularity was classified as not popular.
We found that eslint-plugin-import-extensions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.