Skip to main content
interlace
Plugin: import-nextRules

namespace

Ensure imported namespaces contain dereferenced properties as they are dereferenced

💼 This rule is enabled in the following configs: recommended, typescript.

Rule Details

Reading a name off a namespace import that the module does not export is reported: after import * as ns from './m', each of ns.missing, ns['missing'] and const { missing } = ns.

The rule decides by binding: ns must be the namespace import itself. A default import that happens to be called ns, or a parameter ns that shadows the import, is a different value and is not checked.

The rule needs type information (parserOptions.project or projectService); without it, it is silent. It is also silent for a key chosen at runtime (ns[key]), when the module does not resolve, and when the module is a CommonJS export = module.

❌ Incorrect

// ./math.ts: export const add = ...;
import * as math from './math';
math.subtract(1, 2);
math['multiply'](1, 2);
const { divide } = math;

✅ Correct

import * as math from './math';
math.add(1, 2);
const pick = (key: 'add') => math[key];
const run = (math: { subtract(): void }) => math.subtract();

Options

[]

Implementation

OWASP Foundation

  • Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next
.oxlintrc.json
{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/namespace": "error"  }}
vite.config.ts
import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/namespace': 'error',    },  },});

oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.