Skip to main content
interlace
Plugin: import-nextRules

prefer-node-protocol

Prefer using the node: protocol when importing Node.js builtin modules

💼 This rule is enabled in the following configs: recommended, typescript. 🔧 This rule is automatically fixable by the --fix CLI option.

Rule Details

A Node.js builtin is imported with the node: scheme, so a same-named package in node_modules can never shadow it. Every way a module is loaded or re-exported is checked: import, side-effect import, export … from, export * from, require(), import() and TypeScript's import x = require(). The fix adds the scheme.

A specifier is a builtin when Node's own builtin module list names it exactly: fs, worker_threads, fs/promises. additionalModules adds names (and their subpaths) to treat the same way.

Not reported: a specifier that already has the scheme, and anything Node does not load as a builtin - names are case-sensitive (FS is not fs), events/foo is not a builtin subpath (it resolves to the npm package events), and a trailing slash (punycode/) is Node's documented way to load the npm package instead of the builtin.

❌ Incorrect

import fs from 'fs';
import { readFile } from 'fs/promises';
export { join } from 'path';
import os = require('os');

✅ Correct

import fs from 'node:fs';
import { readFile } from 'node:fs/promises';
import punycode from 'punycode/';

Options

[
  {
    "type": "object",
    "properties": {
      "additionalModules": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "default": []
      }
    },
    "additionalProperties": false
  }
]

Implementation

OWASP Foundation

  • Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next
.oxlintrc.json
{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/prefer-node-protocol": "error"  }}
vite.config.ts
import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/prefer-node-protocol': 'error',    },  },});

oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.