
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Module resolution utilities for Node.js (based on previous work in unjs/mlly, wooorm/import-meta-resolve, and the upstream Node.js implementation).
This library exposes an API similar to import.meta.resolve based on Node.js upstream implementation and resolution algorithm. It supports all built-in functionalities—package.json, import maps, export maps, CJS, and ESM—with some additions:
from using one or more parent URLs.conditions.Install package:
# ✨ Auto-detect (npm, yarn, pnpm, bun, deno)
npx nypm install ores
Import:
// ESM import
import { resolveModuleURL, resolveModulePath } from "ores";
// Or using dynamic import
const { resolveModuleURL, resolveModulePath } = await import("ores");
resolveModuleURL(id, {
/* options */
});
resolveModulePath(id, {
/* options */
});
Differences between resolveModuleURL and resolveModulePath:
resolveModuleURL returns a URL string like file:///app/dep.mjs.resolveModulePath returns an absolute path like /app/dep.mjs.
file:// scheme (for example, data: or node:), it will throw an error.fromA URL, path or array of URLs/paths to resolve module against them.
extensions[".mjs", ".cjs", ".js", ".json"]Additional file extensions to consider when resolving modules.
conditions["node", "import"]Conditions to apply when resolving package exports.
Published under the MIT license.
Based on previous work in unjs/mlly, wooorm/import-meta-resolve and Node.js original implementation.
FAQs
Module resolution utilities based on Node.js upstream implementation.
We found that ores demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.