# Is ssri ESM-only? Can you require() it?

> ssri@14.0.0 is a CommonJS package. CommonJS — require() works on every Node.js version we test.

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Last verified Sep 9, 2026 against ssri@14.0.0.

ssri ships CommonJS only. require("ssri") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js ^22.22.2 || ^24.15.0 || >=26.0.0. import "ssri" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

## What to do

1. require("ssri") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js ^22.22.2 || ^24.15.0 || >=26.0.0.
2. From ES modules use the default import: import ssri from "ssri"; then destructure. Named imports only work when Node.js can statically detect the exports.
3. TypeScript: npm install -D @types/ssri

## Facts

- Latest: 14.0.0 (May 8, 2026)
- Module format: CommonJS
- Last CommonJS version: 14.0.0
- TypeScript types: @types/ssri
- Node engines: ^22.22.2 || ^24.15.0 || >=26.0.0
- Weekly downloads: 37.6M
- License: ISC

## Runtime test results for ssri@14.0.0

Installed and executed on Sep 9, 2026 with require("ssri") from a CommonJS file and import "ssri" from an ES module.

| Runtime | require("ssri") | import "ssri" |
|---|---|---|
| Node.js 18 | works | works |
| Node.js 20 | works | works |
| Node.js 22 | works | works |
| Node.js 24 | works | works |
| Node.js 26 | works | works |
| Bun 1.4.0 | works | works |

## How to import ssri

ES modules:

```js
import ssri from "ssri";
```

CommonJS:

```js
const ssri = require("ssri");
```

## Module format by version

Derived from the type, main and exports fields of every stable release on npm (44 versions; the newest 44 shown).

| Versions | Format | First published |
|---|---|---|
| 0.0.0 – 14.0.0 | CommonJS | Mar 23, 2017 |

## Frequently asked

**Is ssri ESM-only?**

ssri@14.0.0 is a CommonJS package. ssri ships CommonJS only. require("ssri") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js ^22.22.2 || ^24.15.0 || >=26.0.0. import "ssri" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

**Can I import ssri with ES module syntax?**

Yes. import ssri from "ssri" works in Node.js and Bun because they support importing CommonJS modules. Named imports work only when Node.js can statically detect the exports.

**Does ssri work in Bun?**

Yes. import "ssri" loaded successfully in Bun 1.4.0 on Sep 9, 2026.

**Does ssri ship TypeScript types?**

Not bundled. Install the community types with "npm install -D @types/ssri".

## Links

- [ssri on npm](https://www.npmjs.com/package/ssri)
- [Source repository](https://github.com/npm/ssri)
- [HTML version](https://canirequire.com/package/ssri/)
- [JSON version](https://canirequire.com/package/ssri.json)

---

For scripts and AI agents: any package is at https://canirequire.com/package/<name>/index.md (Markdown) or https://canirequire.com/package/<name>.json (JSON); the site index is https://canirequire.com/llms.txt. Fetch the URL directly; no search needed.