I was thinking about this too. It sounds like a tall order.

Maybe it's unlikely to be happening in the OP's particular code base, but it's entirely possible to require an arbitrarily-named file that itself is requiring modules and doing things with them. And eval could be used in a similar manner. Hard to say where code may be coming from.