Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
The mlly npm package is a utility library for working with ES module syntax. It provides functions to analyze and manipulate module specifiers and import/export statements.
Analyzing import/export statements
This feature allows you to analyze the import and export statements within a given piece of code. It returns an object with details about the imports and exports found.
import { analyzeModule } from 'mlly';
const code = `import { foo } from 'bar';`;
const analysis = analyzeModule(code);
Resolving import/export specifiers
This feature helps in resolving the full path of an import specifier based on the current file's location. It is useful for resolving relative paths.
import { resolveImport } from 'mlly';
const resolved = resolveImport('./foo.js', '/path/to/module.js');
Checking for dynamic imports
This feature checks if a given piece of code contains dynamic imports, which are imports that occur within the execution context rather than statically at the top of the file.
import { hasDynamicImport } from 'mlly';
const code = `const module = import('./module.js');`;
const hasDynamic = hasDynamicImport(code);
This package provides a lexer for ES module syntax, allowing for the analysis of import/export statements. It is similar to mlly in that it can be used to parse and understand module structures, but it is implemented as a low-level lexer written in WebAssembly for performance.
Acorn is a JavaScript parser that can be used to analyze and manipulate JavaScript code, including ES modules. While mlly is focused on module syntax, Acorn provides a more general-purpose parsing solution that can handle a wide range of JavaScript features.
Rollup is a module bundler for JavaScript that includes features for analyzing and bundling ES modules. It is more complex and feature-rich than mlly, offering a complete solution for bundling modules for production use, whereas mlly is more focused on module analysis and manipulation.
Missing ECMAScript module utils for Node.js
While ESM Modules are evolving in Node.js ecosystem, there are still many required features that are still experimental or missing or needed to support ESM. This package tries to fill in the gap.
Install npm package:
# using yarn
yarn add mlly
# using npm
npm install mlly
Note: Node.js 14+ is recommended.
Import utils:
// ESM
import {} from "mlly";
// CommonJS
const {} = require("mlly");
Several utilities to make ESM resolution easier:
extensions
and /index
resolutionconditions
resolve
/ resolveSync
Resolve a module by respecting ECMAScript Resolver algorithm (using wooorm/import-meta-resolve).
Additionally supports resolving without extension and /index
similar to CommonJS.
import { resolve, resolveSync } from "mlly";
// file:///home/user/project/module.mjs
console.log(await resolve("./module.mjs", { url: import.meta.url }));
Resolve options:
url
: URL or string to resolve from (default is pwd()
)conditions
: Array of conditions used for resolution algorithm (default is ['node', 'import']
)extensions
: Array of additional extensions to check if import failed (default is ['.mjs', '.cjs', '.js', '.json']
)resolvePath
/ resolvePathSync
Similar to resolve
but returns a path instead of URL using fileURLToPath
.
import { resolvePath, resolveSync } from "mlly";
// /home/user/project/module.mjs
console.log(await resolvePath("./module.mjs", { url: import.meta.url }));
createResolve
Create a resolve
function with defaults.
import { createResolve } from "mlly";
const _resolve = createResolve({ url: import.meta.url });
// file:///home/user/project/module.mjs
console.log(await _resolve("./module.mjs"));
Example: Ponyfill import.meta.resolve:
import { createResolve } from "mlly";
import.meta.resolve = createResolve({ url: import.meta.url });
resolveImports
Resolve all static and dynamic imports with relative paths to full resolved path.
import { resolveImports } from "mlly";
// import foo from 'file:///home/user/project/bar.mjs'
console.log(
await resolveImports(`import foo from './bar.mjs'`, { url: import.meta.url }),
);
isValidNodeImport
Using various syntax detection and heuristics, this method can determine if import is a valid import or not to be imported using dynamic import()
before hitting an error!
When result is false
, we usually need a to create a CommonJS require context or add specific rules to the bundler to transform dependency.
import { isValidNodeImport } from "mlly";
// If returns true, we are safe to use `import('some-lib')`
await isValidNodeImport("some-lib", {});
Algorithm:
data:
return true
(✅ valid) - If is not node:
, file:
or data:
, return false
(
❌ invalid).mjs
, .cjs
, .node
or .wasm
, return true
(✅ valid).js
, return false
(❌ invalid).esm.js
, .es.js
, etc) return false
(
❌ invalid)package.json
file to resolve pathtype: 'module'
field is set, return true
(✅ valid)true
(✅ valid)false
(
❌ invalid)Notes:
hasESMSyntax
Detect if code, has usage of ESM syntax (Static import
, ESM export
and import.meta
usage)
import { hasESMSyntax } from "mlly";
hasESMSyntax("export default foo = 123"); // true
hasCJSSyntax
Detect if code, has usage of CommonJS syntax (exports
, module.exports
, require
and global
usage)
import { hasCJSSyntax } from "mlly";
hasCJSSyntax("export default foo = 123"); // false
detectSyntax
Tests code against both CJS and ESM.
isMixed
indicates if both are detected! This is a common case with legacy packages exporting semi-compatible ESM syntax meant to be used by bundlers.
import { detectSyntax } from "mlly";
// { hasESM: true, hasCJS: true, isMixed: true }
detectSyntax('export default require("lodash")');
createCommonJS
This utility creates a compatible CommonJS context that is missing in ECMAScript modules.
import { createCommonJS } from "mlly";
const { __dirname, __filename, require } = createCommonJS(import.meta.url);
Note: require
and require.resolve
implementation are lazy functions. createRequire
will be called on first usage.
Tools to quickly analyze ESM syntax and extract static import
/export
findStaticImports
Find all static ESM imports.
Example:
import { findStaticImports } from "mlly";
console.log(
findStaticImports(`
// Empty line
import foo, { bar /* foo */ } from 'baz'
`),
);
Outputs:
[
{
type: "static",
imports: "foo, { bar /* foo */ } ",
specifier: "baz",
code: "import foo, { bar /* foo */ } from 'baz'",
start: 15,
end: 55,
},
];
parseStaticImport
Parse a dynamic ESM import statement previously matched by findStaticImports
.
Example:
import { findStaticImports, parseStaticImport } from "mlly";
const [match0] = findStaticImports(`import baz, { x, y as z } from 'baz'`);
console.log(parseStaticImport(match0));
Outputs:
{
type: 'static',
imports: 'baz, { x, y as z } ',
specifier: 'baz',
code: "import baz, { x, y as z } from 'baz'",
start: 0,
end: 36,
defaultImport: 'baz',
namespacedImport: undefined,
namedImports: { x: 'x', y: 'z' }
}
findDynamicImports
Find all dynamic ESM imports.
Example:
import { findDynamicImports } from "mlly";
console.log(
findDynamicImports(`
const foo = await import('bar')
`),
);
findExports
import { findExports } from "mlly";
console.log(
findExports(`
export const foo = 'bar'
export { bar, baz }
export default something
`),
);
Outputs:
[
{
type: "declaration",
declaration: "const",
name: "foo",
code: "export const foo",
start: 1,
end: 17,
},
{
type: "named",
exports: " bar, baz ",
code: "export { bar, baz }",
start: 26,
end: 45,
names: ["bar", "baz"],
},
{ type: "default", code: "export default ", start: 46, end: 61 },
];
findExportNames
Same as findExports
but returns array of export names.
import { findExportNames } from "mlly";
// [ "foo", "bar", "baz", "default" ]
console.log(
findExportNames(`
export const foo = 'bar'
export { bar, baz }
export default something
`),
);
resolveModuleExportNames
Resolves module and reads its contents to extract possible export names using static analyzes.
import { resolveModuleExportNames } from "mlly";
// ["basename", "dirname", ... ]
console.log(await resolveModuleExportNames("mlly"));
Set of utilities to evaluate ESM modules using data:
imports
.json
loaderevalModule
Transform and evaluates module code using dynamic imports.
import { evalModule } from "mlly";
await evalModule(`console.log("Hello World!")`);
await evalModule(
`
import { reverse } from './utils.mjs'
console.log(reverse('!emosewa si sj'))
`,
{ url: import.meta.url },
);
Options:
resolve
optionsurl
: File URLloadModule
Dynamically loads a module by evaluating source code.
import { loadModule } from "mlly";
await loadModule("./hello.mjs", { url: import.meta.url });
Options are same as evalModule
.
transformModule
import.meta.url
will be replaced with url
or from
optionimport { transformModule } from "mlly";
console.log(transformModule(`console.log(import.meta.url)`), {
url: "test.mjs",
});
Options are same as evalModule
.
fileURLToPath
Similar to url.fileURLToPath but also converts windows backslash \
to unix slash /
and handles if input is already a path.
import { fileURLToPath } from "mlly";
// /foo/bar.js
console.log(fileURLToPath("file:///foo/bar.js"));
// C:/path
console.log(fileURLToPath("file:///C:/path/"));
pathToFileURL
Similar to url.pathToFileURL but also handles URL
input and returns a string with file://
protocol.
import { pathToFileURL } from "mlly";
// /foo/bar.js
console.log(pathToFileURL("foo/bar.js"));
// C:/path
console.log(pathToFileURL("C:\\path"));
normalizeid
Ensures id has either of node:
, data:
, http:
, https:
or file:
protocols.
import { ensureProtocol } from "mlly";
// file:///foo/bar.js
console.log(normalizeid("/foo/bar.js"));
loadURL
Read source contents of a URL. (currently only file protocol supported)
import { resolve, loadURL } from "mlly";
const url = await resolve("./index.mjs", { url: import.meta.url });
console.log(await loadURL(url));
toDataURL
Convert code to data:
URL using base64 encoding.
import { toDataURL } from "mlly";
console.log(
toDataURL(`
// This is an example
console.log('Hello world')
`),
);
interopDefault
Return the default export of a module at the top-level, alongside any other named exports.
// Assuming the shape { default: { foo: 'bar' }, baz: 'qux' }
import myModule from "my-module";
// Returns { foo: 'bar', baz: 'qux' }
console.log(interopDefault(myModule));
Options:
preferNamespace
: In case that default
value exists but is not extendable (when is string for example), return input as-is (default is false
, meaning default
's value is prefered even if cannot be extended)sanitizeURIComponent
Replace reserved characters from a segment of URI to make it compatible with rfc2396.
import { sanitizeURIComponent } from "mlly";
// foo_bar
console.log(sanitizeURIComponent(`foo:bar`));
sanitizeFilePath
Sanitize each path of a file name or path with sanitizeURIComponent
for URI compatibility.
import { sanitizeFilePath } from "mlly";
// C:/te_st/_...slug_.jsx'
console.log(sanitizeFilePath("C:\\te#st\\[...slug].jsx"));
parseNodeModulePath
Parses an absolute file path in node_modules
to three segments:
dir
: Path to main directory of packagename
: Package namesubpath
: The optional package subpathIt returns an empty object (with partial keys) if parsing fails.
import { parseNodeModulePath } from "mlly";
// dir: "/src/a/node_modules/"
// name: "lib"
// subpath: "./dist/index.mjs"
const { dir, name, subpath } = parseNodeModulePath(
"/src/a/node_modules/lib/dist/index.mjs",
);
lookupNodeModuleSubpath
Parses an absolute file path in node_modules
and tries to reverse lookup (or guess) the original package exports subpath for it.
import { lookupNodeModuleSubpath } from "mlly";
// subpath: "./utils"
const subpath = lookupNodeModuleSubpath(
"/src/a/node_modules/lib/dist/utils.mjs",
);
MIT - Made with 💛
v1.7.3
FAQs
Missing ECMAScript module utils for Node.js
The npm package mlly receives a total of 4,073,027 weekly downloads. As such, mlly popularity was classified as popular.
We found that mlly demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.