From 3a8a4c3cd0b114141815de2c6b0004d37e2782ee Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Thu, 2 Sep 2021 15:17:42 +0200
Subject: [PATCH 1/9] src: add option to disable loading native addons

---
 doc/api/cli.md                                | 10 +++++++
 doc/node.1                                    |  4 +++
 lib/internal/modules/cjs/helpers.js           |  4 +++
 lib/internal/modules/esm/resolve.js           |  3 ++-
 src/node_binding.cc                           |  5 ++++
 src/node_options.cc                           |  5 ++++
 src/node_options.h                            |  1 +
 test/addons/no-addons/binding.gyp             |  9 +++++++
 test/addons/no-addons/test-worker.js          | 15 +++++++++++
 test/addons/no-addons/test.js                 | 19 ++++++++++++++
 .../node_modules/pkgexports/addons-entry.js   |  3 +++
 .../pkgexports/no-addons-entry.js             |  3 +++
 .../node_modules/pkgexports/package.json      |  4 +++
 .../test-no-addons-resolution-condition.js    | 26 +++++++++++++++++++
 14 files changed, 110 insertions(+), 1 deletion(-)
 create mode 100644 test/addons/no-addons/binding.gyp
 create mode 100644 test/addons/no-addons/test-worker.js
 create mode 100644 test/addons/no-addons/test.js
 create mode 100644 test/fixtures/node_modules/pkgexports/addons-entry.js
 create mode 100644 test/fixtures/node_modules/pkgexports/no-addons-entry.js
 create mode 100644 test/parallel/test-no-addons-resolution-condition.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 48bfd090f65ce4..4eb618775b2a86 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -613,6 +613,14 @@ added: v9.0.0
 Disables runtime checks for `async_hooks`. These will still be enabled
 dynamically when `async_hooks` is enabled.
 
+### `--no-addons`
+<!-- YAML
+added: REPLACEME
+-->
+
+Enable a `no-addons` resolution condition as well as disable loading native addons. When `--no-addons` is specified,
+calling `process.dlopen` or requiring a native C++ addon will fail and throw an exception.
+
 ### `--no-warnings`
 <!-- YAML
 added: v6.0.0
@@ -1424,6 +1432,7 @@ Node.js options that are allowed are:
 * `--no-deprecation`
 * `--no-experimental-repl-await`
 * `--no-force-async-hooks-checks`
+* `--no-addons`
 * `--no-warnings`
 * `--node-memory-debug`
 * `--openssl-config`
@@ -1805,3 +1814,4 @@ $ node --max-old-space-size=1536 index.js
 [security warning]: #warning-binding-inspector-to-a-public-ipport-combination-is-insecure
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
+[`dlopen`]: https://nodejs.org/api/process.html#process_process_dlopen_module_filename_flags
diff --git a/doc/node.1 b/doc/node.1
index 29861a7fab4c86..c24bdb233901e8 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -277,6 +277,10 @@ Silence deprecation warnings.
 Disable runtime checks for `async_hooks`.
 These will still be enabled dynamically when `async_hooks` is enabled.
 .
+.It Fl -no-addons
+Enable a `no-addons` resolution condition as well as disable loading native addons. When `--no-addons` is specified,
+calling `process.dlopen` or requiring a native C++ addon will fail and throw an exception.
+.
 .It Fl -no-warnings
 Silence all process warnings (including deprecations).
 .
diff --git a/lib/internal/modules/cjs/helpers.js b/lib/internal/modules/cjs/helpers.js
index 1e85362a9449d9..9b0b22c4c1988d 100644
--- a/lib/internal/modules/cjs/helpers.js
+++ b/lib/internal/modules/cjs/helpers.js
@@ -33,6 +33,10 @@ let debug = require('internal/util/debuglog').debuglog('module', (fn) => {
 // TODO: Use this set when resolving pkg#exports conditions in loader.js.
 const cjsConditions = new SafeSet(['require', 'node', ...userConditions]);
 
+if (getOptionValue('--no-addons')) {
+  cjsConditions.add('no-addons');
+}
+
 function loadNativeModule(filename, request) {
   const mod = NativeModule.map.get(filename);
   if (mod?.canBeRequiredByUsers) {
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index ca0e1b316fc5b6..9f88a92586646e 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -58,7 +58,8 @@ const { Module: CJSModule } = require('internal/modules/cjs/loader');
 
 const packageJsonReader = require('internal/modules/package_json_reader');
 const userConditions = getOptionValue('--conditions');
-const DEFAULT_CONDITIONS = ObjectFreeze(['node', 'import', ...userConditions]);
+const noAddons = getOptionValue('--no-addons');
+const DEFAULT_CONDITIONS = ObjectFreeze(['node', 'import', ...(noAddons ? ['no-addons'] : []), ...userConditions]);
 const DEFAULT_CONDITIONS_SET = new SafeSet(DEFAULT_CONDITIONS);
 
 /**
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 3c9776e655d0e4..d8abfea67ddcc5 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -415,6 +415,11 @@ inline napi_addon_register_func GetNapiInitializerCallback(DLib* dlib) {
 // cache that's a plain C list or hash table that's shared across contexts?
 void DLOpen(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+
+  if (!env->options()->allow_native_addons) {
+    return THROW_ERR_DLOPEN_FAILED(env, "Cannot load native addon because loading addons is disabled.");
+  }
+
   auto context = env->context();
 
   CHECK_NULL(thread_local_modpending);
diff --git a/src/node_options.cc b/src/node_options.cc
index 40f8cf8690294e..09bf88638dedda 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -402,6 +402,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::force_async_hooks_checks,
             kAllowedInEnvironment,
             true);
+  AddOption("--addons",
+            "disable loading native addons",
+            &EnvironmentOptions::allow_native_addons,
+            kAllowedInEnvironment,
+            true);
   AddOption("--warnings",
             "silence all process warnings",
             &EnvironmentOptions::warnings,
diff --git a/src/node_options.h b/src/node_options.h
index a751d787d7f189..d3899c4c39ddf7 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -121,6 +121,7 @@ class EnvironmentOptions : public Options {
   uint64_t max_http_header_size = 16 * 1024;
   bool deprecation = true;
   bool force_async_hooks_checks = true;
+  bool allow_native_addons = true;
   bool warnings = true;
   bool force_context_aware = false;
   bool pending_deprecation = false;
diff --git a/test/addons/no-addons/binding.gyp b/test/addons/no-addons/binding.gyp
new file mode 100644
index 00000000000000..77f2fced5a3406
--- /dev/null
+++ b/test/addons/no-addons/binding.gyp
@@ -0,0 +1,9 @@
+{
+  'targets': [
+    {
+      'target_name': 'binding',
+      'sources': [ '../hello-world/binding.cc' ],
+      'includes': ['../common.gypi'],
+    }
+  ]
+}
diff --git a/test/addons/no-addons/test-worker.js b/test/addons/no-addons/test-worker.js
new file mode 100644
index 00000000000000..3b0cf77ffa5732
--- /dev/null
+++ b/test/addons/no-addons/test-worker.js
@@ -0,0 +1,15 @@
+'use strict';
+
+const common = require('../../common');
+const assert = require('assert');
+const path = require('path');
+const { Worker } = require('worker_threads');
+
+const binding = path.resolve(__dirname, `./build/${common.buildType}/binding`);
+
+const worker = new Worker(`require(${JSON.stringify(binding)})`, { eval: true });
+
+worker.on('error', common.mustCall((error) => {
+  assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
+  assert.strictEqual(error.message, 'Cannot load native addon because loading addons is disabled.');
+}));
diff --git a/test/addons/no-addons/test.js b/test/addons/no-addons/test.js
new file mode 100644
index 00000000000000..62d9418212c84d
--- /dev/null
+++ b/test/addons/no-addons/test.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const common = require('../../common');
+const assert = require('assert');
+
+const bindingPath = require.resolve(`./build/${common.buildType}/binding`);
+
+let threw = false;
+
+try {
+  require(bindingPath);
+} catch (error) {
+  threw = true;
+  assert(error instanceof Error);
+  assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
+  assert.strictEqual(error.message, 'Cannot load native addon because loading addons is disabled.');
+}
+
+assert(threw);
diff --git a/test/fixtures/node_modules/pkgexports/addons-entry.js b/test/fixtures/node_modules/pkgexports/addons-entry.js
new file mode 100644
index 00000000000000..6487c639f4307c
--- /dev/null
+++ b/test/fixtures/node_modules/pkgexports/addons-entry.js
@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = 'using native addons';
diff --git a/test/fixtures/node_modules/pkgexports/no-addons-entry.js b/test/fixtures/node_modules/pkgexports/no-addons-entry.js
new file mode 100644
index 00000000000000..85096c5aab8e33
--- /dev/null
+++ b/test/fixtures/node_modules/pkgexports/no-addons-entry.js
@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = 'not using native addons';
diff --git a/test/fixtures/node_modules/pkgexports/package.json b/test/fixtures/node_modules/pkgexports/package.json
index 6c80d5cb15a67e..159397bc19096b 100644
--- a/test/fixtures/node_modules/pkgexports/package.json
+++ b/test/fixtures/node_modules/pkgexports/package.json
@@ -20,6 +20,10 @@
     "./nofallback1": [],
     "./nofallback2": [null, {}, "builtin:x"],
     "./nodemodules": "./node_modules/internalpkg/x.js",
+    "./no-addons": {
+      "no-addons": "./no-addons-entry.js",
+      "default": "./addons-entry.js"
+    },
     "./condition": [{
       "custom-condition": {
         "import": "./custom-condition.mjs",
diff --git a/test/parallel/test-no-addons-resolution-condition.js b/test/parallel/test-no-addons-resolution-condition.js
new file mode 100644
index 00000000000000..e0829b4f1ee133
--- /dev/null
+++ b/test/parallel/test-no-addons-resolution-condition.js
@@ -0,0 +1,26 @@
+'use strict';
+
+const { Worker, isMainThread, parentPort } = require('worker_threads');
+const common = require('../common');
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { createRequire } = require('module');
+
+const loadFixture = createRequire(fixtures.path('node_modules'));
+
+if (isMainThread) {
+  [[], ['--no-addons']].map((execArgv) => {
+    const worker = new Worker(__filename, { execArgv });
+
+    worker.on('message', common.mustCall((message) => {
+      if (execArgv.length === 0) {
+        assert.strictEqual(message, 'using native addons');
+      } else {
+        assert.strictEqual(message, 'not using native addons');
+      }
+    }));
+  });
+} else {
+  const message = loadFixture('pkgexports/no-addons');
+  parentPort.postMessage(message);
+}

From 403e52260772f4d670ea775e1acfc23f4654bae6 Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Thu, 2 Sep 2021 16:11:13 +0200
Subject: [PATCH 2/9] fixup: fix linting issues and address feedback

---
 doc/api/cli.md                                 |  5 +++--
 lib/internal/modules/esm/resolve.js            |  9 ++++++++-
 src/node_binding.cc                            |  5 +++--
 test/addons/no-addons/test-worker.js           | 18 +++++++++++++-----
 test/addons/no-addons/test.js                  |  5 ++++-
 .../test-no-addons-resolution-condition.js     | 11 +++++++----
 6 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 4eb618775b2a86..eafb40bd91eb9a 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -618,8 +618,9 @@ dynamically when `async_hooks` is enabled.
 added: REPLACEME
 -->
 
-Enable a `no-addons` resolution condition as well as disable loading native addons. When `--no-addons` is specified,
-calling `process.dlopen` or requiring a native C++ addon will fail and throw an exception.
+Enable a `no-addons` resolution condition as well as disable loading native
+addons. When `--no-addons` is specified, calling `process.dlopen` or requiring
+a native C++ addon will fail and throw an exception.
 
 ### `--no-warnings`
 <!-- YAML
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index 9f88a92586646e..ab739c13ddbe75 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -59,7 +59,14 @@ const { Module: CJSModule } = require('internal/modules/cjs/loader');
 const packageJsonReader = require('internal/modules/package_json_reader');
 const userConditions = getOptionValue('--conditions');
 const noAddons = getOptionValue('--no-addons');
-const DEFAULT_CONDITIONS = ObjectFreeze(['node', 'import', ...(noAddons ? ['no-addons'] : []), ...userConditions]);
+
+const DEFAULT_CONDITIONS = ObjectFreeze([
+  'node',
+  'import',
+  ...(noAddons ? ['no-addons'] : []),
+  ...userConditions,
+]);
+
 const DEFAULT_CONDITIONS_SET = new SafeSet(DEFAULT_CONDITIONS);
 
 /**
diff --git a/src/node_binding.cc b/src/node_binding.cc
index d8abfea67ddcc5..de175b421e6968 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -416,8 +416,9 @@ inline napi_addon_register_func GetNapiInitializerCallback(DLib* dlib) {
 void DLOpen(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  if (!env->options()->allow_native_addons) {
-    return THROW_ERR_DLOPEN_FAILED(env, "Cannot load native addon because loading addons is disabled.");
+  if (UNLIKELY(!env->options()->allow_native_addons)) {
+    return THROW_ERR_DLOPEN_FAILED(
+      env, "Cannot load native addon because loading addons is disabled.");
   }
 
   auto context = env->context();
diff --git a/test/addons/no-addons/test-worker.js b/test/addons/no-addons/test-worker.js
index 3b0cf77ffa5732..52bc06c98399d4 100644
--- a/test/addons/no-addons/test-worker.js
+++ b/test/addons/no-addons/test-worker.js
@@ -7,9 +7,17 @@ const { Worker } = require('worker_threads');
 
 const binding = path.resolve(__dirname, `./build/${common.buildType}/binding`);
 
-const worker = new Worker(`require(${JSON.stringify(binding)})`, { eval: true });
+const worker = new Worker(`require(${JSON.stringify(binding)})`, {
+  eval: true,
+});
 
-worker.on('error', common.mustCall((error) => {
-  assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
-  assert.strictEqual(error.message, 'Cannot load native addon because loading addons is disabled.');
-}));
+worker.on(
+  'error',
+  common.mustCall((error) => {
+    assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
+    assert.strictEqual(
+      error.message,
+      'Cannot load native addon because loading addons is disabled.'
+    );
+  })
+);
diff --git a/test/addons/no-addons/test.js b/test/addons/no-addons/test.js
index 62d9418212c84d..49dab9b29418ac 100644
--- a/test/addons/no-addons/test.js
+++ b/test/addons/no-addons/test.js
@@ -13,7 +13,10 @@ try {
   threw = true;
   assert(error instanceof Error);
   assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
-  assert.strictEqual(error.message, 'Cannot load native addon because loading addons is disabled.');
+  assert.strictEqual(
+    error.message,
+    'Cannot load native addon because loading addons is disabled.'
+  );
 }
 
 assert(threw);
diff --git a/test/parallel/test-no-addons-resolution-condition.js b/test/parallel/test-no-addons-resolution-condition.js
index e0829b4f1ee133..9707f08d999850 100644
--- a/test/parallel/test-no-addons-resolution-condition.js
+++ b/test/parallel/test-no-addons-resolution-condition.js
@@ -1,15 +1,17 @@
 'use strict';
 
-const { Worker, isMainThread, parentPort } = require('worker_threads');
 const common = require('../common');
-const assert = require('assert');
 const fixtures = require('../common/fixtures');
+const { Worker, isMainThread, parentPort } = require('worker_threads');
+const assert = require('assert');
 const { createRequire } = require('module');
 
 const loadFixture = createRequire(fixtures.path('node_modules'));
 
 if (isMainThread) {
-  [[], ['--no-addons']].map((execArgv) => {
+  const tests = [[], ['--no-addons']];
+
+  for (const execArgv of tests) {
     const worker = new Worker(__filename, { execArgv });
 
     worker.on('message', common.mustCall((message) => {
@@ -19,7 +21,8 @@ if (isMainThread) {
         assert.strictEqual(message, 'not using native addons');
       }
     }));
-  });
+  }
+
 } else {
   const message = loadFixture('pkgexports/no-addons');
   parentPort.postMessage(message);

From 099540b7da0620609d101155665ff466e9ed77dd Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Thu, 2 Sep 2021 16:17:04 +0200
Subject: [PATCH 3/9] fixup: remove unused definition

---
 doc/api/cli.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index eafb40bd91eb9a..9e8f0d1ffaf35e 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -1815,4 +1815,3 @@ $ node --max-old-space-size=1536 index.js
 [security warning]: #warning-binding-inspector-to-a-public-ipport-combination-is-insecure
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
-[`dlopen`]: https://nodejs.org/api/process.html#process_process_dlopen_module_filename_flags

From 59eeea9affe56bad25e06b6d04359d723372a63c Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Fri, 3 Sep 2021 16:07:31 +0200
Subject: [PATCH 4/9] fixup: address feedback

---
 doc/api/cli.md                        | 20 +++++------
 doc/api/errors.md                     |  9 +++++
 src/env-inl.h                         |  5 +++
 src/env.h                             |  1 +
 src/node.h                            |  8 ++++-
 src/node_binding.cc                   |  4 +--
 src/node_errors.h                     |  1 +
 src/node_worker.cc                    |  2 ++
 test/addons/no-addons/test-worker.js  | 52 +++++++++++++++++++--------
 test/addons/no-addons/test.js         |  4 ++-
 test/es-module/test-esm-no-addons.mjs | 27 ++++++++++++++
 11 files changed, 105 insertions(+), 28 deletions(-)
 create mode 100644 test/es-module/test-esm-no-addons.mjs

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 9e8f0d1ffaf35e..4804eb386f178a 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -598,6 +598,15 @@ added: v7.10.0
 
 This option is a no-op. It is kept for compatibility.
 
+### `--no-addons`
+<!-- YAML
+added: REPLACEME
+-->
+
+Enable a `no-addons` resolution condition as well as disable loading native
+addons. When `--no-addons` is specified, calling `process.dlopen` or requiring
+a native C++ addon will fail and throw an exception.
+
 ### `--no-deprecation`
 <!-- YAML
 added: v0.8.0
@@ -613,15 +622,6 @@ added: v9.0.0
 Disables runtime checks for `async_hooks`. These will still be enabled
 dynamically when `async_hooks` is enabled.
 
-### `--no-addons`
-<!-- YAML
-added: REPLACEME
--->
-
-Enable a `no-addons` resolution condition as well as disable loading native
-addons. When `--no-addons` is specified, calling `process.dlopen` or requiring
-a native C++ addon will fail and throw an exception.
-
 ### `--no-warnings`
 <!-- YAML
 added: v6.0.0
@@ -1430,10 +1430,10 @@ Node.js options that are allowed are:
 * `--inspect`
 * `--max-http-header-size`
 * `--napi-modules`
+* `--no-addons`
 * `--no-deprecation`
 * `--no-experimental-repl-await`
 * `--no-force-async-hooks-checks`
-* `--no-addons`
 * `--no-warnings`
 * `--node-memory-debug`
 * `--openssl-config`
diff --git a/doc/api/errors.md b/doc/api/errors.md
index 6ad85a2d150600..ccec222b9122a9 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -1027,6 +1027,14 @@ added:
 
 The [debugger][] timed out waiting for the required host/port to be free.
 
+<a id="ERR_DLOPEN_DISABLED"></a>
+### `ERR_DLOPEN_DISABLED`
+<!-- YAML
+added: REPLACEME
+-->
+
+Loading native addons has been disabled using [`--no-addons`][].
+
 <a id="ERR_DLOPEN_FAILED"></a>
 ### `ERR_DLOPEN_FAILED`
 <!-- YAML
@@ -2879,6 +2887,7 @@ The native call from `process.cpuUsage` could not be processed.
 [`'uncaughtException'`]: process.md#event-uncaughtexception
 [`--disable-proto=throw`]: cli.md#--disable-protomode
 [`--force-fips`]: cli.md#--force-fips
+[`--no-addons`]: cli.md#--no-addons
 [`Class: assert.AssertionError`]: assert.md#class-assertassertionerror
 [`ERR_INVALID_ARG_TYPE`]: #err_invalid_arg_type
 [`ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST`]: #err_missing_message_port_in_transfer_list
diff --git a/src/env-inl.h b/src/env-inl.h
index 061897d95d8b5f..156534bdeee8a1 100644
--- a/src/env-inl.h
+++ b/src/env-inl.h
@@ -861,6 +861,11 @@ inline bool Environment::is_main_thread() const {
   return worker_context() == nullptr;
 }
 
+inline bool Environment::no_native_addons() const {
+  return (flags_ & EnvironmentFlags::kNoNativeAddons) ||
+          !options_->allow_native_addons;
+}
+
 inline bool Environment::should_not_register_esm_loader() const {
   return flags_ & EnvironmentFlags::kNoRegisterESMLoader;
 }
diff --git a/src/env.h b/src/env.h
index 4fd5be8e15029b..f7d1dace414963 100644
--- a/src/env.h
+++ b/src/env.h
@@ -1197,6 +1197,7 @@ class Environment : public MemoryRetainer {
   inline void set_has_serialized_options(bool has_serialized_options);
 
   inline bool is_main_thread() const;
+  inline bool no_native_addons() const;
   inline bool should_not_register_esm_loader() const;
   inline bool owns_process_state() const;
   inline bool owns_inspector() const;
diff --git a/src/node.h b/src/node.h
index 8622dff8425d48..e4a7de217e9ee0 100644
--- a/src/node.h
+++ b/src/node.h
@@ -407,7 +407,13 @@ enum Flags : uint64_t {
   // Set this flag to force hiding console windows when spawning child
   // processes. This is usually used when embedding Node.js in GUI programs on
   // Windows.
-  kHideConsoleWindows = 1 << 5
+  kHideConsoleWindows = 1 << 5,
+  // Set this flag to disable loading native addons via `process.dlopen`.
+  // This environment flag is especially important for worker threads
+  // so that a worker thread can't load a native addon even if `execArgv`
+  // is overwritten and `--no-addons` is not specified but was specified
+  // for this Environment instance.
+  kNoNativeAddons = 1 << 6
 };
 }  // namespace EnvironmentFlags
 
diff --git a/src/node_binding.cc b/src/node_binding.cc
index de175b421e6968..050c5dff0ad5fc 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -416,8 +416,8 @@ inline napi_addon_register_func GetNapiInitializerCallback(DLib* dlib) {
 void DLOpen(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  if (UNLIKELY(!env->options()->allow_native_addons)) {
-    return THROW_ERR_DLOPEN_FAILED(
+  if (env->no_native_addons()) {
+    return THROW_ERR_DLOPEN_DISABLED(
       env, "Cannot load native addon because loading addons is disabled.");
   }
 
diff --git a/src/node_errors.h b/src/node_errors.h
index 0f70fe81b9aa1c..f540b3e2a37de4 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -57,6 +57,7 @@ void OnFatalError(const char* location, const char* message);
   V(ERR_CRYPTO_UNKNOWN_DH_GROUP, Error)                                        \
   V(ERR_CRYPTO_UNSUPPORTED_OPERATION, Error)                                   \
   V(ERR_CRYPTO_JOB_INIT_FAILED, Error)                                         \
+  V(ERR_DLOPEN_DISABLED, Error)                                                \
   V(ERR_DLOPEN_FAILED, Error)                                                  \
   V(ERR_EXECUTION_ENVIRONMENT_NOT_AVAILABLE, Error)                            \
   V(ERR_INVALID_ADDRESS, Error)                                                \
diff --git a/src/node_worker.cc b/src/node_worker.cc
index 3e3cb67d9e8c8b..3195ddbaf01b87 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -560,6 +560,8 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
     worker->environment_flags_ |= EnvironmentFlags::kTrackUnmanagedFds;
   if (env->hide_console_windows())
     worker->environment_flags_ |= EnvironmentFlags::kHideConsoleWindows;
+  if (env->no_native_addons())
+    worker->environment_flags_ |= EnvironmentFlags::kNoNativeAddons;
 }
 
 void Worker::StartThread(const FunctionCallbackInfo<Value>& args) {
diff --git a/test/addons/no-addons/test-worker.js b/test/addons/no-addons/test-worker.js
index 52bc06c98399d4..421c1583d99ff5 100644
--- a/test/addons/no-addons/test-worker.js
+++ b/test/addons/no-addons/test-worker.js
@@ -1,3 +1,5 @@
+// Flags: --no-addons
+
 'use strict';
 
 const common = require('../../common');
@@ -7,17 +9,39 @@ const { Worker } = require('worker_threads');
 
 const binding = path.resolve(__dirname, `./build/${common.buildType}/binding`);
 
-const worker = new Worker(`require(${JSON.stringify(binding)})`, {
-  eval: true,
-});
-
-worker.on(
-  'error',
-  common.mustCall((error) => {
-    assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
-    assert.strictEqual(
-      error.message,
-      'Cannot load native addon because loading addons is disabled.'
-    );
-  })
-);
+const expectError = (error) => {
+  assert.strictEqual(error.code, 'ERR_DLOPEN_DISABLED');
+  assert.strictEqual(
+    error.message,
+    'Cannot load native addon because loading addons is disabled.'
+  );
+};
+
+{
+  // flags should be inherited
+  const worker = new Worker(`require(${JSON.stringify(binding)})`, {
+    eval: true,
+  });
+
+  worker.on('error', common.mustCall(expectError));
+}
+
+{
+  // explicitly pass `--no-addons`
+  const worker = new Worker(`require(${JSON.stringify(binding)})`, {
+    eval: true,
+    execArgv: ['--no-addons'],
+  });
+
+  worker.on('error', common.mustCall(expectError));
+}
+
+{
+  // if `execArgv` is overwritten it should still fail to load addons
+  const worker = new Worker(`require(${JSON.stringify(binding)})`, {
+    eval: true,
+    execArgv: [],
+  });
+
+  worker.on('error', common.mustCall(expectError));
+}
diff --git a/test/addons/no-addons/test.js b/test/addons/no-addons/test.js
index 49dab9b29418ac..5c0c72e8169873 100644
--- a/test/addons/no-addons/test.js
+++ b/test/addons/no-addons/test.js
@@ -1,3 +1,5 @@
+// Flags: --no-addons
+
 'use strict';
 
 const common = require('../../common');
@@ -12,7 +14,7 @@ try {
 } catch (error) {
   threw = true;
   assert(error instanceof Error);
-  assert.strictEqual(error.code, 'ERR_DLOPEN_FAILED');
+  assert.strictEqual(error.code, 'ERR_DLOPEN_DISABLED');
   assert.strictEqual(
     error.message,
     'Cannot load native addon because loading addons is disabled.'
diff --git a/test/es-module/test-esm-no-addons.mjs b/test/es-module/test-esm-no-addons.mjs
new file mode 100644
index 00000000000000..a61c1f3b7cb7d2
--- /dev/null
+++ b/test/es-module/test-esm-no-addons.mjs
@@ -0,0 +1,27 @@
+import { mustCall } from '../common/index.mjs';
+import { Worker, isMainThread } from 'worker_threads';
+import assert from 'assert';
+import { fileURLToPath } from 'url';
+import { requireFixture, importFixture } from '../fixtures/pkgexports.mjs';
+
+if (isMainThread) {
+  const tests = [[], ['--no-addons']];
+
+  for (const execArgv of tests) {
+    new Worker(fileURLToPath(import.meta.url), { execArgv });
+  }
+} else {
+  [requireFixture, importFixture].forEach((loadFixture) => {
+    loadFixture('pkgexports/no-addons').then(
+      mustCall((module) => {
+        const message = module.default;
+
+        if (process.execArgv.length === 0) {
+          assert.strictEqual(message, 'using native addons');
+        } else {
+          assert.strictEqual(message, 'not using native addons');
+        }
+      })
+    );
+  });
+}

From 71e09451b343da0b0df13ffd37b71835484a7651 Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Fri, 3 Sep 2021 16:16:16 +0200
Subject: [PATCH 5/9] fixup: fix linter errors

---
 test/addons/no-addons/test-worker.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/addons/no-addons/test-worker.js b/test/addons/no-addons/test-worker.js
index 421c1583d99ff5..1722f03b1065ae 100644
--- a/test/addons/no-addons/test-worker.js
+++ b/test/addons/no-addons/test-worker.js
@@ -18,7 +18,7 @@ const expectError = (error) => {
 };
 
 {
-  // flags should be inherited
+  // Flags should be inherited
   const worker = new Worker(`require(${JSON.stringify(binding)})`, {
     eval: true,
   });
@@ -27,7 +27,7 @@ const expectError = (error) => {
 }
 
 {
-  // explicitly pass `--no-addons`
+  // Explicitly pass `--no-addons`
   const worker = new Worker(`require(${JSON.stringify(binding)})`, {
     eval: true,
     execArgv: ['--no-addons'],
@@ -37,7 +37,7 @@ const expectError = (error) => {
 }
 
 {
-  // if `execArgv` is overwritten it should still fail to load addons
+  // If `execArgv` is overwritten it should still fail to load addons
   const worker = new Worker(`require(${JSON.stringify(binding)})`, {
     eval: true,
     execArgv: [],

From c676d7299436e200b0291085e09a80433a39e90f Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Tue, 7 Sep 2021 12:36:35 +0200
Subject: [PATCH 6/9] fixup: add test for process.dlopen

---
 test/addons/no-addons/test-worker.js | 20 +++++++++++++----
 test/addons/no-addons/test.js        | 33 ++++++++++++++++++++++------
 2 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/test/addons/no-addons/test-worker.js b/test/addons/no-addons/test-worker.js
index 1722f03b1065ae..2a89cef3e2736d 100644
--- a/test/addons/no-addons/test-worker.js
+++ b/test/addons/no-addons/test-worker.js
@@ -9,7 +9,7 @@ const { Worker } = require('worker_threads');
 
 const binding = path.resolve(__dirname, `./build/${common.buildType}/binding`);
 
-const expectError = (error) => {
+const assertError = (error) => {
   assert.strictEqual(error.code, 'ERR_DLOPEN_DISABLED');
   assert.strictEqual(
     error.message,
@@ -23,7 +23,19 @@ const expectError = (error) => {
     eval: true,
   });
 
-  worker.on('error', common.mustCall(expectError));
+  worker.on('error', common.mustCall(assertError));
+}
+
+{
+  // Should throw when using `process.dlopen` directly
+  const worker = new Worker(
+    `process.dlopen({ exports: {} }, ${JSON.stringify(binding)});`,
+    {
+      eval: true,
+    }
+  );
+
+  worker.on('error', common.mustCall(assertError));
 }
 
 {
@@ -33,7 +45,7 @@ const expectError = (error) => {
     execArgv: ['--no-addons'],
   });
 
-  worker.on('error', common.mustCall(expectError));
+  worker.on('error', common.mustCall(assertError));
 }
 
 {
@@ -43,5 +55,5 @@ const expectError = (error) => {
     execArgv: [],
   });
 
-  worker.on('error', common.mustCall(expectError));
+  worker.on('error', common.mustCall(assertError));
 }
diff --git a/test/addons/no-addons/test.js b/test/addons/no-addons/test.js
index 5c0c72e8169873..063dd3491e36fc 100644
--- a/test/addons/no-addons/test.js
+++ b/test/addons/no-addons/test.js
@@ -7,18 +7,37 @@ const assert = require('assert');
 
 const bindingPath = require.resolve(`./build/${common.buildType}/binding`);
 
-let threw = false;
-
-try {
-  require(bindingPath);
-} catch (error) {
-  threw = true;
+const assertError = (error) => {
   assert(error instanceof Error);
   assert.strictEqual(error.code, 'ERR_DLOPEN_DISABLED');
   assert.strictEqual(
     error.message,
     'Cannot load native addon because loading addons is disabled.'
   );
+};
+
+{
+  let threw = false;
+
+  try {
+    require(bindingPath);
+  } catch (error) {
+    assertError(error);
+    threw = true;
+  }
+
+  assert(threw);
 }
 
-assert(threw);
+{
+  let threw = false;
+
+  try {
+    process.dlopen({ exports: {} }, bindingPath);
+  } catch (error) {
+    assertError(error);
+    threw = true;
+  }
+
+  assert(threw);
+}

From 9866c168ab6dd4991021bd4063a5db69752c9f77 Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Wed, 8 Sep 2021 11:23:39 +0200
Subject: [PATCH 7/9] fixup: change polarity of the exports condition

---
 doc/api/cli.md                                |  6 +++---
 doc/api/packages.md                           | 20 +++++++++++++++----
 doc/node.1                                    |  5 +++--
 lib/internal/modules/cjs/helpers.js           | 14 ++++++++-----
 lib/internal/modules/esm/resolve.js           |  3 ++-
 .../node_modules/pkgexports/package.json      |  4 ++--
 6 files changed, 35 insertions(+), 17 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 4804eb386f178a..3f584ea6d1f5c0 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -603,9 +603,9 @@ This option is a no-op. It is kept for compatibility.
 added: REPLACEME
 -->
 
-Enable a `no-addons` resolution condition as well as disable loading native
-addons. When `--no-addons` is specified, calling `process.dlopen` or requiring
-a native C++ addon will fail and throw an exception.
+Disable the `node-addons` exports condition as well as disable loading
+native addons. When `--no-addons` is specified, calling `process.dlopen` or
+requiring a native C++ addon will fail and throw an exception.
 
 ### `--no-deprecation`
 <!-- YAML
diff --git a/doc/api/packages.md b/doc/api/packages.md
index cc4964ea024955..e20bd2aedb931d 100644
--- a/doc/api/packages.md
+++ b/doc/api/packages.md
@@ -537,6 +537,11 @@ Node.js implements the following conditions:
 * `"node"` - matches for any Node.js environment. Can be a CommonJS or ES
    module file. _This condition should always come after `"import"` or
    `"require"`._
+* `"node-addons"` - similar to `"node"` and matches for any Node.js environment.
+   This condition can be used to provide an entry point which uses native C++
+   addons as opposed to an entry point which is more universal and doesn't rely
+   on native addons. This condition can be disabled via the
+   [`--no-addons` flag][].
 * `"default"` - the generic fallback that always matches. Can be a CommonJS
    or ES module file. _This condition should always come last._
 
@@ -615,17 +620,23 @@ node --conditions=development main.js
 ```
 
 which would then resolve the `"development"` condition in package imports and
-exports, while resolving the existing `"node"`, `"default"`, `"import"`, and
-`"require"` conditions as appropriate.
+exports, while resolving the existing `"node"`, `"node-addons"`, `"default"`,
+`"import"`, and `"require"` conditions as appropriate.
 
 Any number of custom conditions can be set with repeat flags.
 
 ### Conditions Definitions
 
-The `"import"`, `"require"`, `"node"` and `"default"` conditions are defined
-and implemented in Node.js core,
+The `"import"`, `"require"`, `"node"`, `"node-addons"` and `"default"`
+conditions are defined and implemented in Node.js core,
 [as specified above](#conditional-exports).
 
+The `"node-addons"` condition can be used to provide an entry point which
+uses native C++ addons. However, this condition can be disabled via the
+[`--no-addons` flag][]. When using `"node-addons"`, it's recommended to treat
+`"default"` as an enhancement that provides a more universal entry point, e.g.
+using WebAssembly instead of a native addon.
+
 Other condition strings are unknown to Node.js and thus ignored by default.
 Runtimes or tools other than Node.js can use them at their discretion.
 
@@ -1249,6 +1260,7 @@ This field defines [subpath imports][] for the current package.
 [`"packageManager"`]: #packagemanager
 [`"type"`]: #type
 [`--conditions` flag]: #resolving-user-conditions
+[`--no-addons` flag]: cli.md#--no-addons
 [`ERR_PACKAGE_PATH_NOT_EXPORTED`]: errors.md#err_package_path_not_exported
 [`esm`]: https://github.com/standard-things/esm#readme
 [`package.json`]: #nodejs-packagejson-field-definitions
diff --git a/doc/node.1 b/doc/node.1
index c24bdb233901e8..9b285dedad1366 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -278,8 +278,9 @@ Disable runtime checks for `async_hooks`.
 These will still be enabled dynamically when `async_hooks` is enabled.
 .
 .It Fl -no-addons
-Enable a `no-addons` resolution condition as well as disable loading native addons. When `--no-addons` is specified,
-calling `process.dlopen` or requiring a native C++ addon will fail and throw an exception.
+Disable the `node-addons` exports condition as well as disable loading native
+addons. When `--no-addons` is specified, calling `process.dlopen` or requiring
+a native C++ addon will fail and throw an exception.
 .
 .It Fl -no-warnings
 Silence all process warnings (including deprecations).
diff --git a/lib/internal/modules/cjs/helpers.js b/lib/internal/modules/cjs/helpers.js
index 9b0b22c4c1988d..a59ec9aca15646 100644
--- a/lib/internal/modules/cjs/helpers.js
+++ b/lib/internal/modules/cjs/helpers.js
@@ -30,12 +30,16 @@ let debug = require('internal/util/debuglog').debuglog('module', (fn) => {
   debug = fn;
 });
 
-// TODO: Use this set when resolving pkg#exports conditions in loader.js.
-const cjsConditions = new SafeSet(['require', 'node', ...userConditions]);
+const noAddons = getOptionValue('--no-addons');
+const addonConditions = noAddons ? [] : ['node-addons'];
 
-if (getOptionValue('--no-addons')) {
-  cjsConditions.add('no-addons');
-}
+// TODO: Use this set when resolving pkg#exports conditions in loader.js.
+const cjsConditions = new SafeSet([
+  'require',
+  'node',
+  ...addonConditions,
+  ...userConditions
+]);
 
 function loadNativeModule(filename, request) {
   const mod = NativeModule.map.get(filename);
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index ab739c13ddbe75..ae4ecc90e4d8ac 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -59,11 +59,12 @@ const { Module: CJSModule } = require('internal/modules/cjs/loader');
 const packageJsonReader = require('internal/modules/package_json_reader');
 const userConditions = getOptionValue('--conditions');
 const noAddons = getOptionValue('--no-addons');
+const addonConditions = noAddons ? [] : ['node-addons'];
 
 const DEFAULT_CONDITIONS = ObjectFreeze([
   'node',
   'import',
-  ...(noAddons ? ['no-addons'] : []),
+  ...addonConditions,
   ...userConditions,
 ]);
 
diff --git a/test/fixtures/node_modules/pkgexports/package.json b/test/fixtures/node_modules/pkgexports/package.json
index 159397bc19096b..7f8f994ac398bd 100644
--- a/test/fixtures/node_modules/pkgexports/package.json
+++ b/test/fixtures/node_modules/pkgexports/package.json
@@ -21,8 +21,8 @@
     "./nofallback2": [null, {}, "builtin:x"],
     "./nodemodules": "./node_modules/internalpkg/x.js",
     "./no-addons": {
-      "no-addons": "./no-addons-entry.js",
-      "default": "./addons-entry.js"
+      "node-addons": "./addons-entry.js",
+      "default": "./no-addons-entry.js"
     },
     "./condition": [{
       "custom-condition": {

From 3fe4bcdc8db0fe8e8ae315fbf3161697d24a52f2 Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Wed, 8 Sep 2021 11:28:49 +0200
Subject: [PATCH 8/9] fixup: add trailing comma

---
 lib/internal/modules/cjs/helpers.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/internal/modules/cjs/helpers.js b/lib/internal/modules/cjs/helpers.js
index a59ec9aca15646..02300a0303e7e2 100644
--- a/lib/internal/modules/cjs/helpers.js
+++ b/lib/internal/modules/cjs/helpers.js
@@ -38,7 +38,7 @@ const cjsConditions = new SafeSet([
   'require',
   'node',
   ...addonConditions,
-  ...userConditions
+  ...userConditions,
 ]);
 
 function loadNativeModule(filename, request) {

From 7cb94e4992644301d81b50d12b33adf2dbd03b88 Mon Sep 17 00:00:00 2001
From: Dominic Elm <elmdominic@gmx.net>
Date: Wed, 8 Sep 2021 15:47:52 +0200
Subject: [PATCH 9/9] fixup: fix tests

---
 .../es-module-loaders/loader-with-custom-condition.mjs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/test/fixtures/es-module-loaders/loader-with-custom-condition.mjs b/test/fixtures/es-module-loaders/loader-with-custom-condition.mjs
index 78ffd75e6be27b..3aefed51d57d3e 100644
--- a/test/fixtures/es-module-loaders/loader-with-custom-condition.mjs
+++ b/test/fixtures/es-module-loaders/loader-with-custom-condition.mjs
@@ -1,8 +1,14 @@
-import {ok, deepStrictEqual} from 'assert';
+import { ok, deepStrictEqual } from 'assert';
 
 export async function resolve(specifier, context, defaultResolve) {
   ok(Array.isArray(context.conditions), 'loader receives conditions array');
-  deepStrictEqual([...context.conditions].sort(), ['import', 'node']);
+
+  deepStrictEqual([...context.conditions].sort(), [
+    'import',
+    'node',
+    'node-addons',
+  ]);
+
   return defaultResolve(specifier, {
     ...context,
     conditions: ['custom-condition', ...context.conditions],