MetaMask · Mrtenz · Jul 24, 2026 · Jul 23, 2026
diff --git a/eslint.config.mjs b/eslint.config.mjs
@@ -432,6 +432,7 @@ const config = createConfig([
       'packages/permission-controller/**',
       'packages/permission-log-controller/**',
       'packages/perps-controller/**',
+      'packages/phishing-controller/**',
       'packages/platform-api-docs/**',
       'packages/polling-controller/**',
       'packages/preferences-controller/**',

@@ -46,8 +46,8 @@
     "changelog:validate": "../../scripts/validate-changelog.sh @metamask/phishing-controller",
     "lint:tsconfigs": "tsx ../../scripts/lint-tsconfigs/lint-tsconfigs.mts",
     "lint:tsconfigs:fix": "tsx ../../scripts/lint-tsconfigs/lint-tsconfigs.mts --fix",
-    "messenger-action-types:check": "tsx ../../packages/messenger-cli/src/cli.ts --formatter oxfmt --check",
-    "messenger-action-types:generate": "tsx ../../packages/messenger-cli/src/cli.ts --formatter oxfmt --generate",
+    "messenger-action-types:check": "tsx ../../packages/messenger-cli/src/cli.ts --formatter oxfmt --esm --check",
+    "messenger-action-types:generate": "tsx ../../packages/messenger-cli/src/cli.ts --formatter oxfmt --esm --generate",
     "since-latest-release": "../../scripts/since-latest-release.sh",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest --reporters=jest-silent-reporter",
     "test:clean": "NODE_OPTIONS=--experimental-vm-modules jest --clearCache",

@@ -11,13 +11,13 @@ import {
   PhishingController,
   SECURITY_ALERTS_BASE_URL,
   TOKEN_BULK_SCANNING_ENDPOINT,
-} from './PhishingController';
+} from './PhishingController.js';
 import type {
   PhishingControllerMessenger,
   PhishingControllerOptions,
-} from './PhishingController';
-import { TokenScanResultType } from './types';
-import type { BulkTokenScanRequest, TokenScanApiResponse } from './types';
+} from './PhishingController.js';
+import { TokenScanResultType } from './types.js';
+import type { BulkTokenScanRequest, TokenScanApiResponse } from './types.js';
 
 jest.mock('@metamask/controller-utils', () => ({
   ...jest.requireActual('@metamask/controller-utils'),

@@ -1,5 +1,5 @@
-import { CacheManager } from './CacheManager';
-import * as utils from './utils';
+import { CacheManager } from './CacheManager.js';
+import * as utils from './utils.js';
 
 describe('CacheManager', () => {
   let updateStateSpy: jest.Mock;

@@ -1,4 +1,4 @@
-import { fetchTimeNow } from './utils';
+import { fetchTimeNow } from './utils.js';
 
 /**
  * Generic cache entry type that wraps the data with a timestamp

@@ -5,8 +5,8 @@ import {
   insertToTrie,
   isTerminal,
   matchedPathPrefix,
-} from './PathTrie';
-import type { PathTrie } from './PathTrie';
+} from './PathTrie.js';
+import type { PathTrie } from './PathTrie.js';
 
 const emptyPathTrie: PathTrie = {};
 

@@ -1,4 +1,4 @@
-import { getHostnameAndPathComponents } from './utils';
+import { getHostnameAndPathComponents } from './utils.js';
 
 export type PathNode = {
   [key: string]: PathNode;

@@ -3,7 +3,7 @@
  * Do not edit manually.
  */
 
-import type { PhishingController } from './PhishingController';
+import type { PhishingController } from './PhishingController.js';
 
 /**
  * Finds known recipient addresses that look like an address poisoning match.

@@ -25,27 +25,30 @@ import {
   SECURITY_ALERTS_BASE_URL,
   ADDRESS_SCAN_ENDPOINT,
   APPROVALS_ENDPOINT,
-} from './PhishingController';
+} from './PhishingController.js';
 import type {
   PhishingControllerOptions,
   BulkPhishingDetectionScanResponse,
   PhishingControllerMessenger,
-} from './PhishingController';
+} from './PhishingController.js';
 import {
   createMockStateChangePayload,
   createMockTransaction,
   formatHostnameToUrl,
   TEST_ADDRESSES,
-} from './tests/utils';
-import type { PhishingDetectionScanResult, AddressScanResult } from './types';
+} from './tests/utils.js';
+import type {
+  PhishingDetectionScanResult,
+  AddressScanResult,
+} from './types.js';
 import {
   PhishingDetectorResultType,
   RecommendedAction,
   AddressScanResultType,
   ApprovalResultType,
   ApprovalFeatureType,
-} from './types';
-import { getHostnameFromUrl } from './utils';
+} from './types.js';
+import { getHostnameFromUrl } from './utils.js';
 
 const controllerName = 'PhishingController';
 

@@ -25,22 +25,26 @@ import { TransactionStatus } from '@metamask/transaction-controller';
 import type { Patch } from 'immer';
 import { toASCII } from 'punycode/punycode.js';
 
-import { findSimilarAddresses } from './address-poisoning';
-import { CacheManager } from './CacheManager';
-import type { CacheEntry } from './CacheManager';
-import { convertListToTrie, insertToTrie, matchedPathPrefix } from './PathTrie';
-import type { PathTrie } from './PathTrie';
+import { findSimilarAddresses } from './address-poisoning.js';
+import { CacheManager } from './CacheManager.js';
+import type { CacheEntry } from './CacheManager.js';
+import {
+  convertListToTrie,
+  insertToTrie,
+  matchedPathPrefix,
+} from './PathTrie.js';
+import type { PathTrie } from './PathTrie.js';
 import type {
   PhishingControllerMaybeUpdateStateAction,
   PhishingControllerMethodActions,
   PhishingControllerTestOriginAction,
-} from './PhishingController-method-action-types';
-import { PhishingDetector } from './PhishingDetector';
+} from './PhishingController-method-action-types.js';
+import { PhishingDetector } from './PhishingDetector.js';
 import {
   PhishingDetectorResultType,
   RecommendedAction,
   AddressScanResultType,
-} from './types';
+} from './types.js';
 import type {
   PhishingDetectorResult,
   PhishingDetectionScanResult,
@@ -52,7 +56,7 @@ import type {
   AddressScanResult,
   SimilarAddressMatch,
   ApprovalsResponse,
-} from './types';
+} from './types.js';
 import {
   applyDiffs,
   fetchTimeNow,
@@ -67,7 +71,7 @@ import {
   isAddressScanSupportedChain,
   isApprovalSupportedChain,
   isTokenScanSupportedChain,
-} from './utils';
+} from './utils.js';
 
 export const PHISHING_CONFIG_BASE_URL =
   'https://phishing-detection.api.cx.metamask.io';

@@ -1,8 +1,8 @@
-import { PhishingDetector } from './PhishingDetector';
-import type { PhishingDetectorOptions } from './PhishingDetector';
-import { formatHostnameToUrl } from './tests/utils';
-import { PhishingDetectorResultType } from './types';
-import { sha256Hash } from './utils';
+import { PhishingDetector } from './PhishingDetector.js';
+import type { PhishingDetectorOptions } from './PhishingDetector.js';
+import { formatHostnameToUrl } from './tests/utils.js';
+import { PhishingDetectorResultType } from './types.js';
+import { sha256Hash } from './utils.js';
 
 describe('PhishingDetector', () => {
   describe('constructor', () => {

@@ -1,9 +1,9 @@
 import { distance } from 'fastest-levenshtein';
 
-import { matchedPathPrefix } from './PathTrie';
-import type { PathTrie } from './PathTrie';
-import { PhishingDetectorResultType } from './types';
-import type { PhishingDetectorResult } from './types';
+import { matchedPathPrefix } from './PathTrie.js';
+import type { PathTrie } from './PathTrie.js';
+import { PhishingDetectorResultType } from './types.js';
+import type { PhishingDetectorResult } from './types.js';
 import {
   domainPartsToDomain,
   domainPartsToFuzzyForm,
@@ -14,7 +14,7 @@ import {
   matchPartsAgainstList,
   processConfigs,
   sha256Hash,
-} from './utils';
+} from './utils.js';
 
 export type LegacyPhishingDetectorList = {
   whitelist?: string[];

@@ -1,4 +1,4 @@
-import { findSimilarAddresses } from './address-poisoning';
+import { findSimilarAddresses } from './address-poisoning.js';
 
 function getNumberRange(start: number, end: number): number[] {
   return Array.from({ length: end - start + 1 }, (_, index) => start + index);

@@ -1,6 +1,6 @@
 import { isValidHexAddress } from '@metamask/controller-utils';
 
-import type { SimilarAddressMatch, SimilarityOptions } from './types';
+import type { SimilarAddressMatch, SimilarityOptions } from './types.js';
 
 const DEFAULT_PREFIX_LEN = 4;
 const DEFAULT_SUFFIX_LEN = 4;

@@ -1,13 +1,13 @@
-export * from './PhishingController';
-export { findSimilarAddresses } from './address-poisoning';
+export * from './PhishingController.js';
+export { findSimilarAddresses } from './address-poisoning.js';
 export type {
   LegacyPhishingDetectorList,
   PhishingDetectorList,
   FuzzyTolerance,
   PhishingDetectorOptions,
   PhishingDetectorConfiguration,
-} from './PhishingDetector';
-export { PhishingDetector } from './PhishingDetector';
+} from './PhishingDetector.js';
+export { PhishingDetector } from './PhishingDetector.js';
 export type {
   PhishingDetectionScanResult,
   AddressScanResult,
@@ -21,22 +21,22 @@ export type {
   Exposure,
   Spender,
   ApprovalFeature,
-} from './types';
-export type { TokenScanCacheData } from './types';
-export { TokenScanResultType } from './types';
+} from './types.js';
+export type { TokenScanCacheData } from './types.js';
+export { TokenScanResultType } from './types.js';
 export {
   PhishingDetectorResultType,
   RecommendedAction,
   AddressScanResultType,
   ApprovalResultType,
   ApprovalFeatureType,
-} from './types';
-export type { CacheEntry } from './CacheManager';
+} from './types.js';
+export type { CacheEntry } from './CacheManager.js';
 export {
   PHISHING_DETECTION_PATH_BASED_ROOT_DOMAINS,
   getPhishingDetectionScanUrlParam,
   isPhishingDetectionPathBasedHostname,
-} from './utils';
+} from './utils.js';
 
 export type {
   PhishingControllerMaybeUpdateStateAction,
@@ -49,4 +49,4 @@ export type {
   PhishingControllerScanAddressAction,
   PhishingControllerGetApprovalsAction,
   PhishingControllerCheckAddressPoisoningAction,
-} from './PhishingController-method-action-types';
+} from './PhishingController-method-action-types.js';
@@ -1,6 +1,6 @@
-import { ListKeys, ListNames } from './PhishingController';
-import type { PhishingListState } from './PhishingController';
-import type { TokenScanResultType } from './types';
+import { ListKeys, ListNames } from './PhishingController.js';
+import type { PhishingListState } from './PhishingController.js';
+import type { TokenScanResultType } from './types.js';
 import {
   applyDiffs,
   buildCacheKey,
@@ -22,7 +22,7 @@ import {
   sha256Hash,
   splitCacheHits,
   validateConfig,
-} from './utils';
+} from './utils.js';
 
 const exampleBlockedUrl = 'https://example-blocked-website.com';
 const exampleBlockedUrlOne = 'https://another-example-blocked-website.com';

@@ -1,26 +1,26 @@
 import { bytesToHex } from '@noble/hashes/utils';
 import { sha256 } from 'ethereum-cryptography/sha256';
 
-import { deleteFromTrie, insertToTrie, deepCopyPathTrie } from './PathTrie';
-import type { Hotlist, PhishingListState } from './PhishingController';
-import { ListKeys, phishingListKeyNameMap } from './PhishingController';
+import { deleteFromTrie, insertToTrie, deepCopyPathTrie } from './PathTrie.js';
+import type { Hotlist, PhishingListState } from './PhishingController.js';
+import { ListKeys, phishingListKeyNameMap } from './PhishingController.js';
 import type {
   PhishingDetectorList,
   PhishingDetectorConfiguration,
-} from './PhishingDetector';
+} from './PhishingDetector.js';
 import {
   ADDRESS_SCAN_SUPPORTED_CHAINS,
   APPROVAL_SUPPORTED_CHAINS,
   DEFAULT_CHAIN_ID_TO_NAME,
   TOKEN_SCAN_SUPPORTED_CHAINS,
-} from './types';
+} from './types.js';
 import type {
   AddressScanSupportedChain,
   ApprovalSupportedChain,
   TokenScanCacheData,
   TokenScanResult,
   TokenScanSupportedChain,
-} from './types';
+} from './types.js';
 
 const DEFAULT_TOLERANCE = 3;