no-full-package-import

💼 This rule is enabled in the following configs: recommended, typescript.

Rule DetailsCopy Anchor Link

Binding a whole large package defeats tree-shaking. For each package in blockedPackages (by exact name), the rule reports a binding of the whole package object: a default import, a namespace import, const x = require('pkg') and import x = require('pkg'). Each entry carries a suggestion (and optional example) for the message. When blockedPackages is not set, a built-in list is used (lodash, lodash-es, rxjs, ramda, moment, underscore, Font Awesome icon packs, aws-sdk and others).

Not reported: named imports, a destructured require, type-only imports (erased, they bundle nothing), side-effect imports, re-exports, and subpaths (lodash/debounce, the recommended form).

❌ IncorrectCopy Anchor Link

import _ from 'lodash';
import * as R from 'ramda';
const moment = require('moment');

✅ CorrectCopy Anchor Link

import debounce from 'lodash/debounce';
import { map } from 'rxjs';
import type Big from 'lodash';

OptionsCopy Anchor Link

[
  {
    "type": "object",
    "properties": {
      "blockedPackages": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "name": {
              "type": "string"
            },
            "suggestion": {
              "type": "string"
            },
            "example": {
              "type": "string"
            }
          },
          "required": [
            "name",
            "suggestion"
          ]
        },
        "default": [],
        "description": "Packages to block full imports from"
      }
    },
    "additionalProperties": false
  }
]

ImplementationCopy Anchor Link

• Source Code
• Test Cases

OWASP FoundationCopy Anchor Link

• Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next

{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/no-full-package-import": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/no-full-package-import': 'error',    },  },});