
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@computerwwwizards/vite-define-plugin
Advanced tools
Flatten a JSON or plain JavaScript config object into Vite's define map under `import.meta.env.*` so you can read structured client-side config at build time without stringifying everything yourself.
Flatten a JSON or plain JavaScript config object into Vite's define map under import.meta.env.* so you can read structured client-side config at build time without stringifying everything yourself.
Given a JSON like:
{
"myCustomConfig": {
"envName": "value"
}
}
You can access it as:
// prints "value"
console.log(import.meta.env.myCustomConfig.envName)
Important: this plugin uses Vite's define replacement. It's a compile-time text substitution, so destructuring or reading whole objects at runtime won't work:
const { myCustomConfig } = import.meta.env
// prints undefined
console.log(myCustomConfig?.envName)
// also prints undefined
console.log(import.meta.env.myCustomConfig)
Why? Because these aren't real reads; Vite replaces occurrences with hardcoded values during build. This is intended for client-side configuration, separate from .env files.
.env files are great, but everything becomes strings. Many apps need arrays, booleans, numbers, and nested shapes for client configuration. A JSON (or JS object) is a natural fit. This plugin lets you keep using the familiar import.meta.env.* access pattern while sourcing values from a structured config.
vite.config.ts
import { defineConfig } from 'vite'
import addConfigToEnv from '@computerwwwizards/vite-define-plugin'
export default defineConfig({
plugins: [addConfigToEnv()]
})
By default, the plugin looks for:
client-config.dev.json in development modeclient-config.json in other modes…relative to Vite's root (or process.cwd() if root isn't set).
Example client-config.dev.json:
{
"someConfig": [5]
}
Usage in source code:
// will print [5]
console.log(import.meta.env.someConfig)
Vite will replace that with:
console.log([5])
The plugin accepts the following options. Types are shown for reference.
| Option | Type | Default | Description |
|---|---|---|---|
initialValuesFile | string | auto-detected file path | Absolute or relative path to a JSON file with initial values. Used when initialValues is not provided. |
initialValuesByMode | Record<string, string> | {} | Select a different JSON file per Vite mode (e.g., { development: 'client-config.dev.json', production: 'client-config.json' }). Overrides initialValuesFile when the key matches the active mode. |
initialValues | object | read from file | Provide a plain object to use directly. When set, the plugin does not read any file. |
keyPrefix | string | 'import.meta.env' | Prefix used for generated keys. Change if you need a different root than import.meta.env. |
separator | string | '.' | Key separator used when flattening nested objects. |
isPlainObject | (obj: unknown) => boolean | internal default | Custom plain-object check, if you need to support different prototypes. |
File resolution, when initialValues is not provided:
initialValuesByMode[env.mode] if presentinitialValuesFile if provided${root || process.cwd()}/client-config.dev.json in development, or ${root || process.cwd()}/client-config.json otherwiseimport { defineConfig } from 'vite'
import addConfigToEnv from '@computerwwwizards/vite-define-plugin'
export default defineConfig({
plugins: [
addConfigToEnv({
initialValuesFile: 'config/app-config.json'
})
]
})
import { defineConfig } from 'vite'
import addConfigToEnv from '@computerwwwizards/vite-define-plugin'
export default defineConfig({
plugins: [
addConfigToEnv({
initialValuesByMode: {
development: 'config/app-config.dev.json',
staging: 'config/app-config.staging.json',
production: 'config/app-config.prod.json'
}
})
]
})
You can provide values directly using initialValues. When set, no file is read.
config/appConfig.ts
export const appConfig = {
featureFlags: {
newNav: true
},
api: {
baseUrl: 'https://api.example.com'
}
}
vite.config.ts
import { defineConfig } from 'vite'
import addConfigToEnv from '@computerwwwizards/vite-define-plugin'
import { appConfig } from './config/appConfig'
export default defineConfig({
plugins: [
addConfigToEnv({
initialValues: appConfig
})
]
})
Or inline:
addConfigToEnv({
initialValues: {
someConfig: [5],
flags: { a: true }
}
})
define. Avoid placing secrets here.keyPrefix (e.g., keyPrefix: 'process.env').FAQs
Flatten a JSON or plain JavaScript config object into Vite's define map under `import.meta.env.*` so you can read structured client-side config at build time without stringifying everything yourself.
We found that @computerwwwizards/vite-define-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.