namespace
Ensure imported namespaces contain dereferenced properties as they are dereferenced
💼 This rule is enabled in the following configs: recommended, typescript.
Rule Details
Reading a name off a namespace import that the module does not export is reported: after import * as ns from './m', each of ns.missing, ns['missing'] and const { missing } = ns.
The rule decides by binding: ns must be the namespace import itself. A default import that happens to be called ns, or a parameter ns that shadows the import, is a different value and is not checked.
The rule needs type information (parserOptions.project or projectService); without it, it is silent. It is also silent for a key chosen at runtime (ns[key]), when the module does not resolve, and when the module is a CommonJS export = module.
❌ Incorrect
// ./math.ts: export const add = ...;
import * as math from './math';
math.subtract(1, 2);
math['multiply'](1, 2);
const { divide } = math;✅ Correct
import * as math from './math';
math.add(1, 2);
const pick = (key: 'add') => math[key];
const run = (math: { subtract(): void }) => math.subtract();Options
[]Implementation
OWASP Foundation
- Category: A00:2021 - General Security
Use this rule
npm install -D oxlint-plugin-import-next{ "jsPlugins": ["oxlint-plugin-import-next"], "rules": { "import-next/namespace": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-import-next'], rules: { 'import-next/namespace': 'error', }, },});oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.