Wildcard package.json exports auto-import path does not apply traversal containment checks

Demo Repo

https://github.com/zainnadeem786/typescript-autoimport-traversal-poc

Which of the following problems are you reporting?

Something else more complicated which I'll explain in more detail

Demonstrate the defect described above with a code sample.

import { LEAKED_SECRET_SYMBOL } from "evil-pkg/secret";

Run tsc --showConfig and paste its output here

{
"compilerOptions": {
"module": "nodenext",
"moduleResolution": "nodenext",
"target": "es2022",
"strict": true
},
"files": [
"./src/app.ts"
]
}

Run tsc --traceResolution and paste its output here

======== Resolving module 'evil-pkg/secret' ========
Module name 'evil-pkg/secret' was not resolved.
======== Module name 'evil-pkg/secret' was not resolved. ========

Paste the package.json of the importing module, if it exists

{
"name": "victim-project",
"private": true,
"type": "module",
"dependencies": {
"evil-pkg": "1.0.0"
}
}

Paste the package.json of the target module, if it exists

{
"name": "evil-pkg",
"version": "1.0.0",
"exports": {
"./": "./../../private/.ts"
}
}

Any other comments can go here

This is not a standard runtime/build-time module resolution mismatch. I selected “Something else more complicated” because the issue is specifically in tsserver package-json auto-import indexing.

Normal module resolution rejects the traversal export target:

resolveModuleName("evil-pkg/secret"): undefined

However, the tsserver auto-import provider still indexes a file outside the package boundary:

D:/TypeScript/msrc-tsserver-autoimport-traversal-poc/victim-project/private/secret.ts

The relevant behavior appears to be in loadEntrypointsFromTargetExports(), where the wildcard export target is expanded and passed to readDirectory() without applying the same traversal/containment validation used by normal export resolution.

The minimal reproduction repository includes a script that demonstrates:

1. normal module resolution rejects the traversal target
2. auto-import indexing still includes the out-of-package file
3. completion details expose the out-of-package symbol metadata

This was originally reviewed by MSRC and treated as defense-in-depth hardening rather than a serviced security vulnerability. MSRC recom
mended opening a GitHub issue so the TypeScript team can consider applying the same ../, ./, and node_modules containment checks to the wildcard branch.

Commencez par loadEntrypointsFromTargetExports() dans le fournisseur d’auto-importation de tsserver et comparez sa gestion des exports wildcard avec la résolution normale des modules. Exécutez la reproduction minimale liée pour observer l’indexation et les métadonnées de completion de la cible de parcours. La tâche est terminée lorsque les exports wildcard rejettent les cibles situées en dehors des limites du package et qu’aucun symbole hors package n’est indexé.