
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@foldkit/vite-plugin
Advanced tools
Vite plugin for Foldkit: view identity branding for the differ, plus hot module reloading with model preservation.
npm install -D @foldkit/vite-plugin
# or
pnpm add -D @foldkit/vite-plugin
# or
yarn add -D @foldkit/vite-plugin
Add the plugin to your vite.config.ts:
import { defineConfig } from 'vite'
import { foldkit } from '@foldkit/vite-plugin'
export default defineConfig({
plugins: [foldkit()],
})
Foldkit's differ tracks two independent kinds of identity: user keys, which match siblings in dynamic lists, and a framework-managed identity, which decides whether a matched position is still the same thing. When the producing view function changes, the differ replaces the node instead of patching it, so DOM state cannot bleed across an identity change. Branches rendered inline by one view function share that function's identity and patch in place, exactly as same-type elements do in React; extracting the branches into named view functions makes them identity boundaries.
This plugin supplies that identity. At build time, in dev and production alike, it wraps every function return in your application modules with a branding call that stamps returned vnodes with the function's id (module path plus function name), set-if-absent. Identity therefore attaches at view-function boundaries, and any branching syntax behaves the same: if/else, ternaries, Effect Match, switch statements, and pattern-matching libraries are all equivalent, because identity belongs to the function that produced the subtree, not to the branch that selected it.
Foldkit core modules are never instrumented, and functions that never return vnodes are wrapped inertly. Builds without this plugin fall back to positional matching plus keys, where branch points need hand-written keys.
When you save a file during development, the plugin:
This means you can make code changes without losing your application's state - forms stay filled, counters keep their values, game positions are maintained, etc.
The plugin uses Vite's WebSocket connection to communicate between the dev server and browser:
Model is preserved across hot reloads but cleared on manual browser refreshes, giving you control over when to reset your app.
When @foldkit/devtools is installed as a development dependency, the plugin mounts its overlay automatically during development and leaves it out of production builds. No application import or devTools.overlay field is needed.
To include the overlay in production, list @foldkit/devtools in regular dependencies and set devTools.show to 'Always'. Dependency placement controls whether Vite includes the overlay, and show controls whether the Foldkit runtime mounts it.
Pass devToolsMcpPort to enable the relay that exposes your running Foldkit app to AI agents via the @foldkit/devtools-mcp MCP server:
plugins: [foldkit({ devToolsMcpPort: 9988 })]
When set, the plugin opens a separate WebSocket server on the given port. The MCP server connects to it and forwards typed Request and Response frames between AI agents and your runtime. Without devToolsMcpPort (the default), the relay is not started and the plugin behaves exactly as before.
See the DevTools MCP documentation for setup, the available tools, and how dispatch validation works.
MIT
FAQs
Vite plugin for Foldkit hot module reloading with state preservation
The npm package @foldkit/vite-plugin receives a total of 2,150 weekly downloads. As such, @foldkit/vite-plugin popularity was classified as popular.
We found that @foldkit/vite-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.