
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
import-module-string
Advanced tools
Use import('data:') and import(Blob) to execute arbitrary JavaScript strings
import-module-stringUse import('data:') and import(Blob) to execute arbitrary JavaScript strings. A simpler alternative to node-retrieve-globals that works in more runtimes.
Available on npm as import-module-string.
npm install import-module-string
export when used, otherwise implicitly export all globals (via var, let, const, function, Array or Object destructuring assignment, import specifiers, etc)import.meta.url when filePath option is suppliedaddRequire option adds support for require() (in Node)acorn for JS parsing only)512MB, Safari 2048MB, Firefox 512MB, Firefox prior to v137 32MB| Feature | Server | Browser |
|---|---|---|
import('./file.js') | ✅ | ✅ (Import Map-friendly) |
import('bare') | ✅ | ✅ (Import Map-friendly) |
import('built-in') | ✅ | N/A |
require() | ✅ with addRequire option | ❌ |
import.meta.url | ✅ with filePath option | ✅ with filePath option |
Notes:
node:fs is one example.bare specifiers are packages referenced by their bare name. In Node this might be a package installed from npm.Import the script first!
import { importFromString } from "import-module-string";
View the test suite file for more examples.
await importFromString(`export var a = 1;
export const c = 3;
export let b = 2;`);
// Returns
{ a: 1, c: 3, b: 2 }
import { importFromString } from "import-module-string";
await importFromString(`var a = 1;
const c = 3;
let b = 2;`);
// Returns
{ a: 1, c: 3, b: 2 }
await importFromString("const a = b;", { data: { b: 2 } });
// Returns
{ a: 2 }
await importFromString("const a = import.meta.url;", { filePath: import.meta.url });
// Returns value for import.meta.url, example shown
{ a: `file:///…` }
// `dependency.js` has the content `export default 2;`
await importFromString("import dep from './dependency.js';");
// Returns
{ dep: 2 }
Uses import.meta.resolve to resolve paths, which will also resolve using Import Maps (where available).
// maps with `import.meta.resolve("@zachleat/noop"))` in-browser (Import Map friendly)
await importFromString("import {noop} from '@zachleat/noop';");
// Returns
{ noop: function() {} }
await importFromString("import fs from 'node:fs';");
// Returns (where available: `node:fs` is not typically available in browser)
{ fs: { /* … */ } }
As a side note, you can shim fs into the browser with memfs.
v2.0.0 removes adapter (no longer necessary!)v1.0.5 bug fixesv1.0.4 add adapter option (add adapter: "fs" or adapter: "fetch") to resolve imports in various environments.FAQs
Use import('data:') and import(Blob) to execute arbitrary JavaScript strings
The npm package import-module-string receives a total of 1,256 weekly downloads. As such, import-module-string popularity was classified as popular.
We found that import-module-string demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.