no-named-as-default-member
Forbid use of exported name as property of default export
💼 This rule is enabled in the following configs: recommended, typescript.
Rule Details
Reading a named export as a property of the module's default import is reported: after import foo from './m', foo.bar where ./m exports bar should be import { bar } from './m'.
The rule does not read the other module. The evidence that ./m exports bar is this file taking bar from the same module: in the default's own declaration (import foo, { bar } from './m'), in another import (plain, or renamed { bar as b }), or in a re-export (export { bar } from './m'). The default can be spelled import foo or import { default as foo }. The read can be foo.bar, foo['bar'] or const { bar } = foo.
The rule decides by binding: a parameter or local foo that shadows the import is a different value. Not reported: a key chosen at runtime (foo[key]), and a name taken from a different module.
❌ Incorrect
import api, { fetchUser } from './api';
api.fetchUser(1);
api['fetchUser'](1);
const { fetchUser: load } = api;✅ Correct
import api, { fetchUser } from './api';
fetchUser(1);
api.version;
const call = (api: { fetchUser(): void }) => api.fetchUser();Options
[]Implementation
OWASP Foundation
- Category: A00:2021 - General Security
Use this rule
npm install -D oxlint-plugin-import-next{ "jsPlugins": ["oxlint-plugin-import-next"], "rules": { "import-next/no-named-as-default-member": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-import-next'], rules: { 'import-next/no-named-as-default-member': 'error', }, },});oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.