ossf / ossf/package-analysis

ES modules fail to be imported during node.js dynamic analysis

Open
#982 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
912
Forks
74
PR merge metrics
No merged PRs in 30d

Description

Around 2k NPM packages per day fail to be analyzed properly due to import errors:

The error messages are in 2 forms, for example:

  1. Failed to import @versini/ui-components: Error [ERR_REQUIRE_ESM]: require() of ES Module /app/node_modules/@versini/ui-components/dist/index.js from /usr/local/bin/analyze-node.js not supported.
  2. Failed to import isolate-package: Error [ERR_REQUIRE_ESM]: require() of ES Module /app/node_modules/isolate-package/dist/index.mjs not supported.

(the difference is that the first variant specifies from /usr/local/bin/analyze-node.js, and usually occurs when attempting to import an index.js file; the second variant is when importing .mjs files)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by examining the Node.js dynamic-analysis entry point named in the errors, analyze-node.js, and reproduce imports for the reported index.js and .mjs examples. Done means both ES module forms can be analyzed without ERR_REQUIRE_ESM failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.