Dynamic Script Evaluation in JavaScript

You have a String of JavaScript code. How can you execute it? This is a playground for testing various dynamic script execution methods in Node.js and what features they support.

This is research for import-module-string (the approach I currently use and recommend for ESM code) and node-retrieve-globals (legacy but more CommonJS friendly), whose features I have documented in a separate compatibility table below.

• vm Node.js documentation
• MDN docs for eval
• import("data:…") approach from 2ality.com
• import("blob:…") approach suggested by David Bushnell (not currently supported in Node.js but works in Deno!)

Runtime Native Methods

JavaScript Feature	Module#_compile	Function()	vm.Script	vm.Module	import("data:…") (or blob:…)
Assign module.exports (CommonJS-only)	Yes	No	Yes	No5	No
export (ESM-only)	No	No	No	Yes1	Yes
require	Yes	Yes	Yes	Yes1	No6
import (ESM-only)	No4	No4	No4	Yes1	No7
Dynamic import()	Yes	Yes	Yes2	Yes1	No7
Top level async or await	Faux3	Faux3	Faux3	Yes1	Yes
Can leak to global scope	Yes	Yes	No	No	Yes
Runtime Compatibility	Node.js	Any	Node.js	Node.js	Any

Notes:

1. Requires --experimental-vm-modules. Use outputs an ExperimentalWarning to the console.
2. Requires vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER an experimental Node feature added in v21.7.0, v20.12.0. Any use outputs an ExperimentalWarning to the console.
3. Requires the code to be wrapped in an (async () => {})() IIFE wrapper.
4. Can use esm-import-transformer to transform static import to dynamic import() or require: https://github.com/zachleat/esm-import-transformer
5. Probably shimmable but not worth it.
6. require is shimmable in Node.js via node:module#createRequire
7. import of runtime built-ins (e.g. node: prefixed modules in Node.js) are allowed.

npm Packages

JavaScript Feature	npm:node-retrieve-globals	npm:import-module-string
Assign module.exports (CommonJS-only)	Yes	No
export (ESM-only)	No	Yes
require	Yes	Yes
import (ESM-only)	No	Yes
Dynamic import()	Yes	Yes
Top level async or await	Faux3	Yes
Can leak to global scope	Yes	Yes
Runtime Compatibility	Node.js	Any

Alternate methods

• A lot of the pain here is due to an experimental vm.Module. If you already have access to a bundler (e.g. esbuild), use that to output CommonJS code and run it through Module#_compile to bypass current limitations with dynamic ESM in Node.js.
  • Vite writes a temporary file to the filesystem to workaround this issue.
  • Some more discussion on Mastodon.