"imports" field (subpath imports)

Node 12.19+ supports an imports field in package.json that remaps a package's internal specifiers. Any bare specifier starting with # resolves through this map before normal resolution.

{
  "imports": {
    "#db": "./src/database.js",
    "#auth": "./src/auth.js"
  }
}

Change the map and you change what every #db import loads. The risk is subtle. NODE_PATH needs control of the environment, but subpath imports live in package.json, which is already dense with config and gets less careful review than source. A PR that flips "#auth": "./src/auth.js" to "./src/auth-patched.js" looks like a routine refactor. It still reroutes every #auth import.

Conditional imports make it worse. Conditions like node vs default can make a redirect environment-specific, so it activates only in production or CI and dodges local testing.