Comment by throwAGIway

Basically the only forbidden thing is dynamically calculating import paths, or dynamically generating the module.exports object.