
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
esm-loader-typescript
Advanced tools
Node.js ESModule Loader for importing and loading
Typescript (.ts
) files and transpiling on the fly.
Warning! Using experimental Node.js features and flags, API will likely change. This may be helpful for development and testing, but should not be used in production.
npm install --save-dev esm-loader-typescript
We want to import a .ts
file with Node.js:
// index.ts
const words: string = 'hello'
console.log(words)
// 'hello'
If a tsconfig.json
file is found, it will be loaded and used. Otherwise, we
provide a bare-bones default config which will be used instead.
NODE_OPTIONS="--experimental-loader esm-loader-typescript" node index.ts
This loader can be configured, and chained with other loaders, using node-esm-loader. This should be your only loader handling Typescript files.
npm install --save-dev node-esm-loader
// .loaderrc.js
export default {
loaders: ['esm-loader-typescript'],
}
NODE_OPTIONS="--experimental-loader node-esm-loader" node index.ts
// .loaderrc.js
export default {
loaders: [
{
loader: 'esm-loader-typescript',
options: {
debug: true,
},
},
],
}
.js
files, so relative imports are suggested
to have no file extension. But in our case, since we're transpiling
on-the-fly, these extensionless imports leave Node.js confused. Use this
loader to add .ts
extensions to any relative imports which are missing
them, allowing Node.js to resolve and load the files.FAQs
Chainable ESModule Loader for Typescript
The npm package esm-loader-typescript receives a total of 1,685 weekly downloads. As such, esm-loader-typescript popularity was classified as popular.
We found that esm-loader-typescript demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.