[Bug]: --install treats node: built-in imports as node@latest

[kowanietz]

What happened?

zx --install detects node: built-in imports as an npm package named node.

This script has no third-party dependencies:

import fs from 'node:fs'
import path from 'node:path'

console.log(fs.existsSync(path.resolve('.')))

But running it with --install attempts to install node@latest:

npm install --no-save --no-audit --no-fund --prefix=/path/to/script node@latest

Multiple node:* imports collapse into the same unintended dependency, so it does not install one package per built-in, but it still tries to install the npm package node. That package is unrelated to node:fs or node:path, which are provided by the runtime.

How it should work?

node:* imports should be handled as Node.js built-ins and skipped by dependency detection, the same way fs, path, etc. are skipped.

How to reproduce the bug?

Create script.mjs:

import fs from 'node:fs'
import path from 'node:path'

console.log('script ran:', fs.existsSync(path.resolve('.')))

Run:

zx --install script.mjs

Expected: no package install is needed.

Actual: zx invokes npm with node@latest.

The parser shows the same behavior directly:

const { parseDeps } = require('./build/deps.cjs')

console.log(parseDeps("import fs from 'node:fs'\nimport path from 'node:path'\n"))
// { node: 'latest' }

Version

8.9.0 / main

What's OS kind?

MacOS

What JS runtime is used?

Node.js

Runtime Version

25.2.1

Error stack / relevant log output

npm install --no-save --no-audit --no-fund --prefix=/path/to/script node@latest

Code of Conduct

• I agree to follow this project's Code of Conduct

[AnnasMazhar]

I'd like to fix this. The parsePackageName function should skip specifiers containing : since npm package names cannot contain colons — this safely handles node:, npm:, jsr:, and file: protocol imports.

Draft PR incoming.