
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
import-meta-resolve
Advanced tools
Resolve things like Node.js.
This package is a ponyfill for import.meta.resolve.
It supports everything you need to resolve files just like modern Node does:
import maps, export maps, loading CJS and ESM projects, all of that!
As of Node.js 20.0, import.meta.resolve is still behind an experimental flag.
This package can be used to do what it does in Node 16–20.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install import-meta-resolve
import {resolve} from 'import-meta-resolve'
// A file:
console.log(resolve('./index.js', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/index.js
// A CJS package:
console.log(resolve('builtins', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/node_modules/builtins/index.js
// A scoped CJS package:
console.log(resolve('@eslint/eslintrc', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/node_modules/@eslint/eslintrc/lib/index.js
// A package with an export map:
console.log(resolve('micromark/lib/parse', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/node_modules/micromark/lib/parse.js
// A node builtin:
console.log(resolve('fs', import.meta.url))
//=> node:fs
This package exports the identifiers moduleResolve and
resolve.
There is no default export.
resolve(specifier, parent)Match import.meta.resolve except that parent is required (you can pass
import.meta.url).
specifier (string)
— the module specifier to resolve relative to parent
(/example.js, ./example.js, ../example.js, some-package, fs, etc)parent (string, example: import.meta.url)
— the absolute parent module URL to resolve from; you must pass
import.meta.url or something elseFull file:, data:, or node: URL (string) to the found thing
Throws an ErrnoException.
moduleResolve(specifier, parent, conditions, preserveSymlinks)The “Resolver Algorithm Specification” as detailed in the Node docs
(which is slightly lower-level than resolve).
specifier (string)
— /example.js, ./example.js, ../example.js, some-package, fs, etcparent (URL, example: import.meta.url)
— full URL (to a file) that specifier is resolved relative fromconditions (Set<string>, default: new Set(['node', 'import']))
— conditionspreserveSymlinks (boolean, default: false)
— keep symlinks instead of resolving themA URL object (URL) to the found thing.
Throws an ErrnoException.
ErrnoExceptionOne of many different errors that occur when resolving (TypeScript type).
type ErrnoExceptionFields = Error & {
errnode?: number | undefined
code?: string | undefined
path?: string | undefined
syscall?: string | undefined
url?: string | undefined
}
The code field on errors is one of the following strings:
'ERR_INVALID_MODULE_SPECIFIER'
— when specifier is invalid (example: '#')'ERR_INVALID_PACKAGE_CONFIG'
— when a package.json is invalid (example: invalid JSON)'ERR_INVALID_PACKAGE_TARGET'
— when a package.json exports or imports is invalid (example: when it
does not start with './')'ERR_MODULE_NOT_FOUND'
— when specifier cannot be found in parent (example: 'some-missing-package')'ERR_NETWORK_IMPORT_DISALLOWED'
— thrown when trying to resolve a local file or builtin from a remote file
(node:fs relative to 'https://example.com')'ERR_PACKAGE_IMPORT_NOT_DEFINED'
— when a local import is not defined in an import map (example: '#local'
when not defined)'ERR_PACKAGE_PATH_NOT_EXPORTED'
— when an export is not defined in an export map (example: 'tape/index.js',
which is not in its export map)'ERR_UNSUPPORTED_DIR_IMPORT'
— when attempting to import a directory (example: './lib/')'ERR_UNKNOWN_FILE_EXTENSION'
— when somehow reading a file that has an unexpected extensions ('./readme.md')'ERR_INVALID_ARG_VALUE'
— when conditions is incorrectThe algorithm for resolve matches how Node handles import.meta.resolve, with
a couple of differences.
The algorithm for moduleResolve matches the Resolver Algorithm
Specification as detailed in the Node docs (which is sync and slightly
lower-level than resolve).
parent defaulting to import.meta.url cannot be ponyfilled: you have to
explicitly pass it--conditions,
--experimental-default-type,
--experimental-json-modules,
--experimental-network-imports,
--experimental-policy,
--experimental-wasm-modules,
--input-type,
--no-addons,
--preserve-symlinks, nor
--preserve-symlinks-main
workWATCH_REPORT_DEPENDENCIES env variableString#slice
or so from being tampered with, whereas this doesn’tThis package is fully typed with TypeScript.
It exports the additional type ErrnoException.
This package is at least compatible with all maintained versions of Node.js. As of now, that is Node.js 16 and later.
Yes please! See How to Contribute to Open Source.
MIT © Titus Wormer and Node.js contributors
The 'resolve' package is a popular Node.js module resolution algorithm that can be used programmatically. It is similar to import-meta-resolve but does not specifically target ES module resolution semantics. It is more general-purpose and can resolve CommonJS modules as well.
This package is used internally by webpack to resolve module paths. It is highly configurable and can handle complex resolution scenarios, including loaders and plugin systems. While it offers more features than import-meta-resolve, it is also more complex and tailored to webpack's ecosystem.
FAQs
Resolve things like Node.js — ponyfill for `import.meta.resolve`
The npm package import-meta-resolve receives a total of 10,434,156 weekly downloads. As such, import-meta-resolve popularity was classified as popular.
We found that import-meta-resolve demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.