
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
load-esm is a tiny utility that lets CommonJS (CJS) TypeScript projects dynamically import pure ESM packages at runtime—without hacks like eval().
It helps avoid errors like:
Error [ERR_REQUIRE_ESM]: require() of ES ModuleError [ERR_PACKAGE_PATH_NOT_EXPORTED]: No "exports" main defined in ...npm install load-esm
# or
yarn add load-esm
# or
pnpm add load-esm
Works in CJS TypeScript projects. No config changes required.
// TypeScript (CJS project)
import { loadEsm } from "load-esm";
(async () => {
const esmModule = await loadEsm("esm-module");
// use esmModule...
})();
import { loadEsm } from "load-esm";
(async () => {
const esmModule = await loadEsm<typeof import("esm-module")>("esm-module");
// esmModule is fully typed
})();
import { loadEsm } from "load-esm";
(async () => {
try {
// Import a pure ESM package from a CommonJS TS project
const { fileTypeFromFile } = await loadEsm<typeof import("file-type")>(
"file-type"
);
const type = await fileTypeFromFile("fixture.gif");
console.log(type);
} catch (error) {
console.error("Error importing module:", error);
}
})();
Note: Because top‑level
awaitisn’t available in CommonJS, examples use an async IIFE.
function loadEsm<T = unknown>(name: string): Promise<T>
Parameters
name — Package name or file path to import.Returns
Promise<T> resolving to the imported module namespace.In CJS TypeScript projects ("module": "commonjs"), the TS compiler transpiles dynamic import() to require(), which breaks when the target is a pure ESM package.
load-esm executes the import() outside of TypeScript’s transpilation scope, preserving native dynamic import() semantics at runtime. This keeps your code type‑safe while avoiding brittle workarounds (e.g., wrapping import() in eval()).
Since Node.js 22.12, require can load some ESM modules, but there are documented constraints. If your dependencies are compatible with that path, you might not need this utility. load-esm remains useful when:
import() (see Compatibility) but not the newer require() behavior.If Node’s built‑in
require(esm)works for your packages and version, feel free to use it.
import() support)ERR_REQUIRE_ESM: Ensure you’re using load-esm(...) to import the ESM dependency from CJS code.No "exports" main defined: Some packages only expose ESM entry points. Import them via load-esm.loadEsm<typeof import("pkg")>("pkg") for typed access.See Releases.
Inspired by common pain points when mixing CJS projects with modern ESM‑only libraries.
FAQs
Utility to dynamically load ESM modules in TypeScript CommonJS projects
The npm package load-esm receives a total of 2,392,235 weekly downloads. As such, load-esm popularity was classified as popular.
We found that load-esm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.