no-nodejs-modules

💼 This rule is enabled in the following configs: recommended, typescript.

Rule DetailsCopy Anchor Link

Code meant for a browser or an edge runtime must not load a Node.js builtin. Every way a module is loaded or re-exported is checked: import, side-effect import, export … from, export * from, require(), import() and TypeScript's import x = require().

A specifier is a builtin when Node's own builtin module list names it, with or without the node: scheme, subpaths included: fs, node:fs, fs/promises, worker_threads. additionalBuiltins adds more names; allow exempts a builtin by name, in either spelling (fs and node:fs are the same module). suggestAlternatives only adds a browser-side hint to the message.

Not reported: import type and export type (erased at compile time, they load nothing), and a package or path that only looks like a builtin (fs-extra, ./fs).

❌ IncorrectCopy Anchor Link

import fs from 'fs';
import { readFile } from 'node:fs/promises';
export * from 'path';
const os = require('os');

✅ CorrectCopy Anchor Link

import type { Stats } from 'node:fs';
import fsExtra from 'fs-extra';
import helper from './fs';

OptionsCopy Anchor Link

[
  {
    "type": "object",
    "properties": {
      "allow": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Node.js builtins to allow."
      },
      "additionalBuiltins": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Additional modules to treat as builtins."
      },
      "suggestAlternatives": {
        "type": "boolean",
        "default": true,
        "description": "Suggest browser-compatible alternatives."
      }
    },
    "additionalProperties": false
  }
]

ImplementationCopy Anchor Link

• Source Code
• Test Cases

OWASP FoundationCopy Anchor Link

• Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next

{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/no-nodejs-modules": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/no-nodejs-modules': 'error',    },  },});