
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
Module resolution utilities for Node.js (based on previous work in unjs/mlly, wooorm/import-meta-resolve, and the upstream Node.js implementation).
This library exposes an API similar to import.meta.resolve based on Node.js's upstream implementation and resolution algorithm. It supports all built-in functionalities—import maps, export maps, CJS, and ESM—with some additions:
Install the package:
# ✨ Auto-detect (npm, yarn, pnpm, bun, deno)
npx nypm install exsolve
Import:
// ESM import
import { resolveModuleURL, resolveModulePath, createResolver, clearResolveCache } from "exsolve";
// Or using dynamic import
const { resolveModulePath } = await import("exsolve");
resolveModuleURL(id, {/* options */});
resolveModulePath(id, {/* options */});
Differences between resolveModuleURL and resolveModulePath:
resolveModuleURL returns a URL string like file:///app/dep.mjs.resolveModulePath returns an absolute path like /app/dep.mjs.
file:// scheme (e.g., data: or node:), it will throw an error.You can create a custom resolver instance with default options using createResolver.
Example:
import { createResolver } from "exsolve";
const { resolveModuleURL, resolveModulePath } = createResolver({
suffixes: ["", "/index"],
extensions: [".mjs", ".cjs", ".js", ".mts", ".cts", ".ts", ".json"],
conditions: ["node", "import", "production"],
});
To speed up resolution, resolved values (and errors) are globally cached with a unique key based on id and options (and the current working directory, when from is missing or relative). Each cache hit for an error throws a new copy.
Parsed package.json files are cached along with the resolve cache that read them: clearing it (with clearResolveCache(), a resolver's clearResolveCache() or cache.clear()) or passing a new cache object also reads them again, and with cache: false they are only reused within a single call.
Example: Invalidate all (global) cache entries (to support file-system changes).
import { clearResolveCache } from "exsolve";
clearResolveCache();
Example: Custom resolver with custom cache object.
import { createResolver } from "exsolve";
const { clearResolveCache, resolveModulePath } = createResolver({
cache: new Map(),
});
Example: Resolve without cache.
import { resolveModulePath } from "exsolve";
resolveModulePath("id", { cache: false });
tryIf set to true and the module cannot be resolved, the resolver returns undefined instead of throwing an error.
Example:
// undefined
const resolved = resolveModuleURL("non-existing-package", { try: true });
fromA URL, path, or array of URLs/paths from which to resolve the module.
If not provided, resolution starts from the current working directory. Setting this option is recommended.
You can use import.meta.url for from to mimic the behavior of import.meta.resolve().
[!TIP] For better performance, ensure the value is a
file://URL or at least ends with/.If it is set to an absolute path, the resolver must first check the filesystem to see if it is a file or directory. If the input is a
file://URL or ends with/, the resolver can skip this check.
conditionsConditions to apply when resolving package exports (default: ["node", "import"]).
Example:
// "/app/src/index.ts"
const src = resolveModuleURL("pkg-name", {
conditions: ["deno", "node", "import", "production"],
});
[!NOTE] Conditions are applied without order. The order is determined by the
exportsfield inpackage.json.
extensionsAdditional file extensions to check as fallbacks.
Example:
// "/app/src/index.ts"
const src = resolveModulePath("./src/index", {
extensions: [".mjs", ".cjs", ".js", ".mts", ".cts", ".ts", ".json"],
});
[!TIP] For better performance, use explicit extensions and avoid this option.
suffixesPath suffixes to check.
Example:
// "/app/src/utils/index.ts"
const src = resolveModulePath("./src/utils", {
suffixes: ["", "/index"],
extensions: [".mjs", ".cjs", ".js"],
});
[!TIP] For better performance, use explicit
/indexwhen needed and avoid this option.
preserveSymlinksIf set to true, symlinks are not resolved to their real path (similar to Node.js --preserve-symlinks).
Example:
// file:///path/to/link.mjs (instead of the symlink target)
const resolved = resolveModuleURL("./link.mjs", { from: import.meta.url, preserveSymlinks: true });
cacheResolve cache (enabled by default with a shared global object).
Can be set to false to disable or a custom Map to bring your own cache object.
See cache for more info.
Use explicit module extensions .mjs or .cjs instead of .js:
This allows the resolution fast path to skip reading the closest package.json for the type.
Published under the MIT license.
Based on previous work in unjs/mlly, wooorm/import-meta-resolve and Node.js original implementation.
A widely used package implementing Node.js-style module resolution. It offers a familiar resolution model and sync and async APIs; exsolve is another option with a lightweight utility-oriented API.
Resolves a module as though it were required from a specified directory. It is a focused alternative when resolving a package from a particular location; exsolve also provides path-resolution utilities.
A configurable resolver used by tools such as webpack. It supports extensive hooks and customization, making it more feature-rich for bundler use; exsolve is generally a simpler choice for common Node.js resolution tasks.
Provides module resolution based on the ESM import.meta.resolve semantics. It is useful when matching ESM resolution behavior specifically, while exsolve offers a broader set of convenient resolution utilities.
FAQs
Module resolution utilities based on Node.js upstream implementation.
The npm package exsolve receives a total of 44,385,729 weekly downloads. As such, exsolve popularity was classified as popular.
We found that exsolve demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.