Security News
RubyGems.org Adds New Maintainer Role
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
The mlly npm package is a utility library for working with ES module syntax. It provides functions to analyze and manipulate module specifiers and import/export statements.
Analyzing import/export statements
This feature allows you to analyze the import and export statements within a given piece of code. It returns an object with details about the imports and exports found.
import { analyzeModule } from 'mlly';
const code = `import { foo } from 'bar';`;
const analysis = analyzeModule(code);
Resolving import/export specifiers
This feature helps in resolving the full path of an import specifier based on the current file's location. It is useful for resolving relative paths.
import { resolveImport } from 'mlly';
const resolved = resolveImport('./foo.js', '/path/to/module.js');
Checking for dynamic imports
This feature checks if a given piece of code contains dynamic imports, which are imports that occur within the execution context rather than statically at the top of the file.
import { hasDynamicImport } from 'mlly';
const code = `const module = import('./module.js');`;
const hasDynamic = hasDynamicImport(code);
This package provides a lexer for ES module syntax, allowing for the analysis of import/export statements. It is similar to mlly in that it can be used to parse and understand module structures, but it is implemented as a low-level lexer written in WebAssembly for performance.
Acorn is a JavaScript parser that can be used to analyze and manipulate JavaScript code, including ES modules. While mlly is focused on module syntax, Acorn provides a more general-purpose parsing solution that can handle a wide range of JavaScript features.
Rollup is a module bundler for JavaScript that includes features for analyzing and bundling ES modules. It is more complex and feature-rich than mlly, offering a complete solution for bundling modules for production use, whereas mlly is more focused on module analysis and manipulation.
Missing ECMAScript module utils for Node.js
While ESM Modules are evolving in Node.js ecosystem, there are still many required features that are still experimental or missing or needed to support ESM. This package tries to fill in the gap.
Install npm package:
# using yarn
yarn add mlly
# using npm
npm install mlly
Note: Node.js 14+ is recommand.
Import utils:
// ESM
import { } from 'mlly'
// CommonJS
const { } = require('mlly')
Several utilities to make ESM resolution easier:
extensions
and /index
resolutionconditions
resolve
Resolve a module by respecting ECMAScript Resolver algorithm (internally using wooorm/import-meta-resolve that exposes Node.js implementation).
Additionally supports resolving without extension and /index
similar to CommonJS.
import { resolve } from 'mlly'
// file:///home/user/project/module.mjs
console.log(await resolve('./module.mjs', { url: import.meta.url }))
Resolve options:
url
: URL or string to resolve from (default is pwd()
)conditions
: Array of conditions used for resolution algorithm (default is ['node', 'import']
)extensions
: Array of additional extensions to check if import failed (default is ['.mjs', '.cjs', '.js', '.json']
)resolvePath
Similar to resolve
but returns a path instead of URL using fileURLToPath
.
import { resolvePath } from 'mlly'
// //home/user/project/module.mjs
console.log(await resolvePath('./module.mjs', { url: import.meta.url }))
createResolve
Create a resolve
function with defaults.
import { createResolve } from 'mlly'
const _resolve = createResolve({ url: import.meta.url })
// file:///home/user/project/module.mjs
console.log(await _resolve('./module.mjs'))
Example: Ponyfill import.meta.resolve:
import { createResolve } from 'mlly'
import.meta.resolve = createResolve({ url: import.meta.url })
resolveImports
Resolve all static and dynamic imports with relative paths to full resolved path.
import { resolveImports } from 'mlly'
// import foo from 'file:///home/user/project/bar.mjs'
console.log(await resolveImports(`import foo from './bar.mjs'`, { url: import.meta.url }))
isValidNodeImport
Using various syntax detection and heuristics, this method can determine if import is a valid import or not to be imported using dynamic import()
before hitting an error!
When resault is false
, we usually need a to create a CommonJS require context or add specific rules to the bundler to transform dependency.
import { isValidNodeImport } from 'mlly'
// If returns true, we are safe to use `import('some-lib')`
await isValidNodeImport('some-lib', {})
Algorithm:
data:
return true
(✅ valid)node:
, file:
or data:
, return false
(
❌ invalid).mjs
, .cjs
, .node
or .wasm
, return true
(✅ valid).js
, return false
(❌ invalid).esm.js
, .es.js
, etc) return false
(
❌ invalid)package.json
file to resolve pathtype: 'module'
field is set, return true
(✅ valid)true
(✅ valid)false
(
❌ invalid)Notes:
hasESMSyntax
Detect if code, has usage of ESM syntax (Static import
, ESM export
and import.meta
usage)
import { hasESMSyntax } from 'mlly'
hasESMSyntax('export default foo = 123') // true
hasCJSSyntax
Detect if code, has usage of CommonJS syntax (exports
, module.exports
, require
and global
usage)
import { hasCJSSyntax } from 'mlly'
hasCJSSyntax('export default foo = 123') // false
detectSyntax
Tests code against both CJS and ESM.
isMixed
indicates if both are detected! This is a common case with legacy packages exporting semi-compatible ESM syntax meant to be used by bundlers.
import { detectSyntax } from 'mlly'
// { hasESM: true, hasCJS: true, isMixed: true }
detectSyntax('export default require("lodash")')
createCommonJS
This utility creates a compatible CommonJS context that is missing in ECMAScript modules.
import { createCommonJS } from 'mlly'
const { __dirname, __filename, require } = createCommonJS(import.meta.url)
Note: require
and require.resolve
implementation are lazy functions. createRequire
will be called on first usage.
Tools to quikcly analyze ESM synax and extract static import
/export
findStaticImports
Find all static ESM imports.
Example:
import { findStaticImports } from 'mlly'
console.log(findStaticImports(`
// Empty line
import foo, { bar /* foo */ } from 'baz'
`))
Outputs:
[
{
type: 'static',
imports: 'foo, { bar /* foo */ } ',
specifier: 'baz',
code: "import foo, { bar /* foo */ } from 'baz'",
start: 15,
end: 55
}
]
parseStaticImport
Parse a dynamic ESM import statement previusly matched by findStaticImports
.
Example:
import { findStaticImports, parseStaticImport } from 'mlly'
const [match0] = findStaticImports(`import baz, { x, y as z } from 'baz'`)
console.log(parseStaticImport(match0))
Outputs:
{
type: 'static',
imports: 'baz, { x, y as z } ',
specifier: 'baz',
code: "import baz, { x, y as z } from 'baz'",
start: 0,
end: 36,
defaultImport: 'baz',
namespacedImport: undefined,
namedImports: { x: 'x', y: 'z' }
}
findDynamicImports
Find all dynamic ESM imports.
Example:
import { findDynamicImports } from 'mlly'
console.log(findDynamicImports(`
const foo = await import('bar')
`))
findExports
Note: API Of this function might be broken in a breaking change for code matcher
import { findExports } from 'mlly'
console.log(findExports(`
export const foo = 'bar'
export { bar, baz }
export default something
`))
Outputs:
[
{
type: 'declaration',
declaration: 'const',
name: 'foo',
code: 'export const foo',
start: 1,
end: 17
},
{
type: 'named',
exports: ' bar, baz ',
code: 'export { bar, baz }',
start: 26,
end: 45,
names: [ 'bar', 'baz' ]
},
{ type: 'default', code: 'export default ', start: 46, end: 61 }
]
Set of utilities to evaluate ESM modules using data:
imports
.json
loaderevalModule
Transform and evaluates module code using dynamic imports.
import { evalModule } from 'mlly'
await evalModule(`console.log("Hello World!")`)
await evalModule(`
import { reverse } from './utils.mjs'
console.log(reverse('!emosewa si sj'))
`, { url: import.meta.url })
Options:
resolve
optionsurl
: File URLloadModule
Dynamically loads a module by evaluating source code.
import { loadModule } from 'mlly'
await loadModule('./hello.mjs', { url: import.meta.url })
Options are same as evalModule
.
transformModule
import.meta.url
will be replaced with url
or from
optionimport { toDataURL } from 'mlly'
console.log(transformModule(`console.log(import.meta.url)`), { url: 'test.mjs' })
Options are same as evalModule
.
fileURLToPath
Similar to url.fileURLToPath but also converts windows backslash \
to unix slash /
and handles if input is already a path.
import { fileURLToPath } from 'mlly'
// /foo/bar.js
console.log(fileURLToPath('file:///foo/bar.js'))
// C:/path
console.log(fileURLToPath('file:///C:/path/'))
normalizeid
Ensures id has either of node:
, data:
, http:
, https:
or file:
protocols.
import { ensureProtocol } from 'mlly'
// file:///foo/bar.js
console.log(normalizeid('/foo/bar.js'))
loadURL
Read source contents of a URL. (currently only file protocol supported)
import { resolve, loadURL } from 'mlly'
const url = await resolve('./index.mjs', { url: import.meta.url })
console.log(await loadURL(url))
toDataURL
Convert code to data:
URL using base64 encoding.
import { toDataURL } from 'mlly'
console.log(toDataURL(`
// This is an example
console.log('Hello world')
`))
interopDefault
Return the default export of a module at the top-level, alongside any other named exports.
// Assuming the shape { default: { foo: 'bar' }, baz: 'qux' }
import myModule from 'my-module'
// Returns { foo: 'bar', baz: 'qux' }
console.log(interopDefault(myModule))
sanitizeURIComponent
Replace reserved charachters from a segment of URI to make it compatible with rfc2396.
import { sanitizeURIComponent } from 'mlly'
// foo_bar
console.log(sanitizeURIComponent(`foo:bar`))
sanitizeFilePath
Sanitize each path of a file name or path with sanitizeURIComponent
for URI compatibility.
import { sanitizeFilePath } from 'mlly'
// C:/te_st/_...slug_.jsx'
console.log(sanitizeFilePath('C:\\te#st\\[...slug].jsx'))
MIT - Made with ❤️
FAQs
Missing ECMAScript module utils for Node.js
The npm package mlly receives a total of 4,988,360 weekly downloads. As such, mlly popularity was classified as popular.
We found that mlly demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.
Security News
Research
Socket's threat research team has detected five malicious npm packages targeting Roblox developers, deploying malware to steal credentials and personal data.