canirequire

How the data is produced

canirequire.com is an independent, open reference: for each of the most-used npm packages it records the module format (ESM-only, dual, CommonJS, or no entry), the last version with a CommonJS build, and whether require() and import actually work on Node.js 18–26 and Bun. It has no affiliation with Auth0 and is unrelated to Auth0's "Can I require?" tool for Auth0 Actions and Webtask.

1. Registry metadata

For each package we download the full document from registry.npmjs.org, which contains the package.json of every published version. For every stable version we look at:

A version is ESM-only when it has a native ESM entry and no CommonJS entry, dual when it has both, and CommonJS when it has only a CommonJS entry. The last CommonJS version is the newest stable release that still had a CommonJS entry; ESM-only since is the first release after it that dropped CommonJS.

2. Runtime probes

Metadata can lie, so each package's latest version is also installed into an empty project and executed:

// from a .cjs file
const m = require("<pkg>");

// from a .mjs file
import * as m from "<pkg>";

Both snippets run on Node.js 18.20.8, 20.20.2, 22.22.1, 24.21.0 and 26.8.1 (one build per major, the newest available when the probe ran) and on Bun 1.4.0. Results are recorded per major; a package that changes behaviour within a major between patch releases can differ from what is shown. The probe checks that the module loads, not that its API works. A run passes when the process exits 0 within 30 seconds. On failure we record the Node.js error code (for example ERR_REQUIRE_ESM, ERR_REQUIRE_ASYNC_MODULE, ERR_PACKAGE_PATH_NOT_EXPORTED). Failures on CommonJS packages usually point to a missing peer dependency, a browser global, or a native binary rather than a module-format problem.

1690 of 1710 packages have runtime results so far; the latest probe ran on Wed Sep 09 2026.

3. Types

A package "bundles" types when its latest version declares types/typings or a types export condition. Otherwise we check whether @types/<name> exists on npm.

Scope

The dataset covers the most-downloaded and most-depended-upon packages on npm. Pre-release versions are ignored. Download counts come from the npm downloads API.

Background: why require() of ESM is complicated

Historically require() could only load CommonJS. Node.js 22.12 (and the 20.19 backport) enabled require(esm) by default: require() can load an ES module as long as the module graph is synchronous. Packages that use top-level await still fail with ERR_REQUIRE_ASYNC_MODULE. That is why this site shows results per Node.js major instead of a single yes/no.

Use from scripts and AI agents

Every page can be fetched directly; no search step is needed.

A 404 means the package is not in the dataset (the 1710 most-used packages). In that case read its package.json from https://registry.npmjs.org/<name>/latest: a require condition in exports, or no "type": "module", means it can be required.

curl -s https://canirequire.com/package/chalk/index.md
curl -s https://canirequire.com/package/chalk.json | jq .nextSteps