Dynamic Script Evaluation in JavaScript

You have a String of JavaScript code. How can you execute it? This is a playground for testing various dynamic script execution methods in Node.js and what features they support.

This is research for import-module-string (the approach I currently use and recommend for ESM code) and node-retrieve-globals (legacy but more CommonJS friendly), whose features I have documented in a separate compatibility table below.

vm Node.js documentation
MDN docs for eval
import("data:…") approach from 2ality.com
import("blob:…") approach suggested by David Bushnell (not currently supported in Node.js but works in Deno!)

Runtime Native Methods

JavaScript Feature	`Module#_compile`	`Function()`	`vm.Script`	`vm.Module`	`import("data:…")` (or `blob:…`)
Assign `module.exports` (CommonJS-only)	Yes	No	Yes	No⁵	No
`export` (ESM-only)	No	No	No	Yes¹	Yes
`require`	Yes	Yes	Yes	Yes¹	No⁶
`import` (ESM-only)	No⁴	No⁴	No⁴	Yes¹	No⁷
Dynamic `import()`	Yes	Yes	Yes²	Yes¹	No⁷
Top level `async` or `await`	Faux³	Faux³	Faux³	Yes¹	Yes
Can leak to global scope	Yes	Yes	No	No	Yes
Runtime Compatibility	Node.js	Any	Node.js	Node.js	Any

Notes:

Requires --experimental-vm-modules. Use outputs an ExperimentalWarning to the console.
Requires vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER an experimental Node feature added in v21.7.0, v20.12.0. Any use outputs an ExperimentalWarning to the console.
Requires the code to be wrapped in an (async () => {})() IIFE wrapper.
Can use esm-import-transformer to transform static import to dynamic import() or require: https://github.com/zachleat/esm-import-transformer
Probably shimmable but not worth it.
require is shimmable in Node.js via node:module#createRequire
import of runtime built-ins (e.g. node: prefixed modules in Node.js) are allowed.

npm Packages

JavaScript Feature	`npm:node-retrieve-globals`	`npm:import-module-string`
Assign `module.exports` (CommonJS-only)	Yes	No
`export` (ESM-only)	No	Yes
`require`	Yes	Yes
`import` (ESM-only)	No	Yes
Dynamic `import()`	Yes	Yes
Top level `async` or `await`	Faux³	Yes
Can leak to global scope	Yes	Yes
Runtime Compatibility	Node.js	Any

Alternate methods

A lot of the pain here is due to an experimental vm.Module. If you already have access to a bundler (e.g. esbuild), use that to output CommonJS code and run it through Module#_compile to bypass current limitations with dynamic ESM in Node.js.
- Vite writes a temporary file to the filesystem to workaround this issue.
- Some more discussion on Mastodon.

zachleat/javascript-eval-modules

ErrorLooks like something went wrong!

About

Resources

Uh oh!

Stars

Watchers

Forks

Uh oh!

Languages

Error
Looks like something went wrong!