Rule Proposal: disallow thirdparty module which has the same name as a core module.

[mysticatea]

If you depend on third-party modules which have the same name as a core module indirectly, you may use the third-party modules instead of core modules silently because of flattening node_modules. This might cause unintentional behaviors.

This rule reports use of such third-party modules.

This rule ignores deprecated core modules.

{
    "node/no-hide-core-modules": ["error", {
        "allow": [],
        "checkMode": "indirectOnly"
    }]
}

• allow is the option to allow to hide specific core modules. E.g. allow: ["util"].
• checkMode
  • "all" disallows such third-party modules.
  • "directOnly" disallows such third-party modules but allows those if those are in indirect dependencies.
  • "indirectOnly" (default) disallows such third-party modules but allows those if those are in direct dependencies. This option allows those if you wrote those in package.json explicitly.