[wruza]

Could you please point to “strange things” that people do with “exports” AND how it prevents static analyzers from doing their job? Why they can do it for:

  var x = strange_thing()

but suddenly can not when “x” is renamed to “exports”?

[Ginden]

Eg.

    module.exports = {foo: 3};
    setImmediate(() => module.exports[Math.random() > 0.5 ? 'foo' : 'bar'] = 5);

This is impossible for ES modules, because exports are static and known at parse time.

Few widely used packages do something like:

    enhanceWithAdditionalProperties(module.exports, mixin);

[wruza]

Not the same but similar:

  export var foo = 3
  setImmediate(() => {foo = Math.random()})

Under ESM, exported values are still not known at parse time, and may be changed by the library (but not created nor deleted). And given that exported may be changed, what prevents library makers from doing:

  export default var exports = { }
  enhance(exports, mixin)

and you are left with heuristics again?

I see these subtle differences, but fail to see how they are a solution to the problem of “doing strange things to exports”.