# How the data is produced > How canirequire classifies npm packages as ESM-only, dual or CommonJS, finds the last CommonJS version, and tests require() and import on Node.js 18–26 and Bun. canirequire.com is an independent, open reference: for each of the most-used npm packages it records the module format (ESM-only, dual, CommonJS, or no entry), the last version with a CommonJS build, and whether require() and import actually work on Node.js 18–26 and Bun. It has no affiliation with Auth0 and is unrelated to Auth0's "Can I require?" tool for Auth0 Actions and Webtask. ## 1. Registry metadata For each package we download the full document from registry.npmjs.org, which contains the package.json of every published version. For every stable version we look at: - exports: a require condition means a CommonJS entry exists; an import condition means a native ESM entry exists. Plain string targets are classified by extension (.cjs, .mjs) or, for .js, by the type field. - main and type when there is no exports map. - module: a bundler-only ESM hint. It does not make a package importable as ESM in Node.js, so it is reported separately. A version is **ESM-only** when it has a native ESM entry and no CommonJS entry, **dual** when it has both, and **CommonJS** when it has only a CommonJS entry. The **last CommonJS version** is the newest stable release that still had a CommonJS entry; **ESM-only since** is the first release after it that dropped CommonJS. ## 2. Runtime probes Metadata can lie, so each package's latest version is also installed into an empty project and executed: ```js // from a .cjs file const m = require(""); // from a .mjs file import * as m from ""; ``` Both snippets run on Node.js 18.20.8, 20.20.2, 22.22.1, 24.21.0 and 26.8.1 (one build per major, the newest available when the probe ran) and on Bun 1.4.0. Results are recorded per major; a package that changes behaviour within a major between patch releases can differ from what is shown. The probe checks that the module loads, not that its API works. A run passes when the process exits 0 within 30 seconds. On failure we record the Node.js error code (for example ERR_REQUIRE_ESM, ERR_REQUIRE_ASYNC_MODULE, ERR_PACKAGE_PATH_NOT_EXPORTED). Failures on CommonJS packages usually point to a missing peer dependency, a browser global, or a native binary rather than a module-format problem. 1690 of 1710 packages have runtime results so far; the latest probe ran on Wed Sep 09 2026. ## 3. Types A package "bundles" types when its latest version declares types/typings or a types export condition. Otherwise we check whether @types/ exists on npm. ## Scope The dataset covers the most-downloaded and most-depended-upon packages on npm. Pre-release versions are ignored. Download counts come from the npm downloads API. ## Background: why require() of ESM is complicated Historically require() could only load CommonJS. Node.js 22.12 (and the 20.19 backport) enabled require(esm) by default: require() can load an ES module as long as the module graph is synchronous. Packages that use top-level await still fail with ERR_REQUIRE_ASYNC_MODULE. That is why this site shows results per Node.js major instead of a single yes/no. ## Use from scripts and AI agents Every page can be fetched directly; no search step is needed. - Package as Markdown: https://canirequire.com/package//index.md (short form https://canirequire.com/package/.md also works; scoped packages keep the slash: https://canirequire.com/package/@babel/core/index.md) - Package as JSON: https://canirequire.com/package/.json, including a nextSteps array and the runtime matrix - Package as HTML: https://canirequire.com/package// - All packages in one request: https://canirequire.com/search-index.json, an array of [name, format, lastCommonJsVersion, latestVersion] - Lists as Markdown: https://canirequire.com/esm-only/index.md, https://canirequire.com/dual/index.md, https://canirequire.com/commonjs/index.md, https://canirequire.com/no-entry/index.md - Site map for agents: https://canirequire.com/llms.txt A 404 means the package is not in the dataset (the 1710 most-used packages). In that case read its package.json from https://registry.npmjs.org//latest: a "require" condition in exports (or no "type": "module") means it can be required. Example: ```sh curl -s https://canirequire.com/package/chalk/index.md curl -s https://canirequire.com/package/chalk.json | jq .nextSteps ``` --- For scripts and AI agents: any package is at https://canirequire.com/package//index.md (Markdown) or https://canirequire.com/package/.json (JSON); the site index is https://canirequire.com/llms.txt. Fetch the URL directly; no search needed.