Skip to main content
interlace
Plugin: import-nextRules

no-unused-modules

Forbid modules without exports

💼 This rule is enabled in the following configs: recommended, typescript.

Rule Details

This rule enforces a convention: every module exports something. It reports a module that has no export at all.

An export is any way the module hands a value out: ESM export (named, default, export * from, a type), TypeScript export =, and CommonJS writes to the real module.exports or exports: module.exports =, module['exports'] =, exports.a =, module.exports.a =, and Object.defineProperty(exports, …) / Object.assign(module.exports, …). A write to a local or parameter that is merely named exports exports nothing. export {} exports nothing but is how TypeScript marks a file as a module on purpose, so it is not reported.

allowImportOnly exempts a module that imports something (ESM import, require(), or import x = require()) and exports nothing, such as an entry point that wires other modules together.

❌ Incorrect

console.log('nothing leaves this file');

function fill(exports: Record<string, unknown>) {
  exports.a = 1;
}

✅ Correct

export const a = 1;
module.exports.handler = () => {};
Object.defineProperty(exports, 'version', { value: '1.0.0' });

Options

[
  {
    "type": "object",
    "properties": {
      "allowImportOnly": {
        "type": "boolean",
        "default": false,
        "description": "Allow modules that only contain imports."
      }
    },
    "additionalProperties": false
  }
]

Implementation

OWASP Foundation

  • Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next
.oxlintrc.json
{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/no-unused-modules": "error"  }}
vite.config.ts
import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/no-unused-modules': 'error',    },  },});

oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.