• Rollup version:
• OS: Windows 10 Enterprise 20H2
• Node.js version: 12.22.1 (x64)

When extracting the base name of a module from its module ID, @rollup/plugin-commonjs does not correctly normalize paths with separators that are not path.sep. This happens with some custom resolvers (e.g. Vite.js) which generate module IDs with forward slashes on Windows.

For example, if the module ID is C:/Users/Phil/Documents/GitHub/test-vite-app/node_modules/react/index.js, the plugin generates code like this on Windows:

var C__Users_Phil_Documents_GitHub_testViteApp_node_modules_react = { exports: {} };
var react_production_min = {};

This is undesireable because (1) it leaks the absolute path of the development machine into the bundle, and (2) it generates bundles with different hashes on different machines, hurting reproducible builds.

This is caused by getName(), which is used to extract the base name of a module:

Here, it uses path.sep to split the module ID. Since sep is \ on Windows, it fails to split paths that use /.

Since basename() and dirname() can handle both forward and backward slashes, I suggest that we replace lines 30-31 with:

  return makeLegalIdentifier(basename(dirname(id))); 

See related investigation at vitejs/vite#2623 (comment)