# Is nsp ESM-only? Can you require() it?

> nsp@3.2.1 is a CommonJS package. CommonJS — require() works on every Node.js version we test.

The Node Security (nodesecurity.io) command line interface

Last verified Sep 9, 2026 against nsp@3.2.1.

nsp ships CommonJS only. require("nsp") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >=6.0.0. import "nsp" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

**Deprecated:** The Node Security Platform service is shutting down 9/30 - https://blog.npmjs.org/post/175511531085/the-node-security-platform-service-is-shutting

## What to do

1. require("nsp") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >=6.0.0.
2. From ES modules use the default import: import nsp from "nsp"; then destructure. Named imports only work when Node.js can statically detect the exports.
3. TypeScript: no types are available for nsp; declare the module yourself if you need them.
4. This package is deprecated: The Node Security Platform service is shutting down 9/30 - https://blog.npmjs.org/post/175511531085/the-node-security-platform-service-is-shutting

## Facts

- Latest: 3.2.1 (Feb 15, 2018)
- Module format: CommonJS
- Last CommonJS version: 3.2.1
- TypeScript types: none
- Node engines: >=6.0.0
- Weekly downloads: 18K
- License: Apache-2.0

## Runtime test results for nsp@3.2.1

Installed and executed on Sep 9, 2026 with require("nsp") from a CommonJS file and import "nsp" from an ES module.

| Runtime | require("nsp") | import "nsp" |
|---|---|---|
| Node.js 18 | works | works |
| Node.js 20 | works | works |
| Node.js 22 | works | works |
| Node.js 24 | works | works |
| Node.js 26 | works | works |
| Bun 1.4.0 | works | works |

## How to import nsp

ES modules:

```js
import nsp from "nsp";
```

CommonJS:

```js
const nsp = require("nsp");
```

## Module format by version

Derived from the type, main and exports fields of every stable release on npm (46 versions; the newest 46 shown).

| Versions | Format | First published |
|---|---|---|
| 0.0.1 – 3.2.1 | CommonJS | Mar 17, 2014 |

## Frequently asked

**Is nsp ESM-only?**

nsp@3.2.1 is a CommonJS package. nsp ships CommonJS only. require("nsp") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >=6.0.0. import "nsp" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

**Can I import nsp with ES module syntax?**

Yes. import nsp from "nsp" works in Node.js and Bun because they support importing CommonJS modules. Named imports work only when Node.js can statically detect the exports.

**Does nsp work in Bun?**

Yes. import "nsp" loaded successfully in Bun 1.4.0 on Sep 9, 2026.

**Does nsp ship TypeScript types?**

No. nsp ships no type declarations and there is no @types package for it.

## Links

- [nsp on npm](https://www.npmjs.com/package/nsp)
- [Source repository](https://github.com/nodesecurity/nsp)
- [HTML version](https://canirequire.com/package/nsp/)
- [JSON version](https://canirequire.com/package/nsp.json)

---

For scripts and AI agents: any package is at https://canirequire.com/package/<name>/index.md (Markdown) or https://canirequire.com/package/<name>.json (JSON); the site index is https://canirequire.com/llms.txt. Fetch the URL directly; no search needed.