
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@lovable.dev/lovite
Advanced tools
Vite config wrapper for Lovable sandbox environments.
npm install lovite
or
pnpm add lovite
or
yarn add lovite
Simply replace Vite's defineConfig with lovite's:
// Before
import { defineConfig } from 'vite';
// After
import { defineConfig } from 'lovite';
import react from '@vitejs/plugin-react-swc';
import path from 'path';
export default defineConfig({
server: {
host: '::',
port: 8080,
},
plugins: [react()],
resolve: {
alias: {
'@': path.resolve(__dirname, './src'),
},
},
});
lovite provides three layers of automatic configuration:
@ to resolve to ./src for cleaner importsIn development mode, lovite automatically configures settings to improve the developer experience:
lovable-tagger plugin for component identificationbuild.sourcemap: true) for better debuggingThese enhancements apply in all environments (local and sandbox) when running in development mode.
lovite automatically detects when your code is running in a Lovable sandbox environment (via the LOVABLE_SANDBOX environment variable) and enforces specific configurations required for proper operation:
When running in a Lovable sandbox, the following settings are automatically enforced:
8080 (required for Lovable's proxy routing):: (IPv6 support for network binding)true (fail fast if port is unavailable)lovite automatically configures the @ path alias to resolve to your src directory:
// No configuration needed - this just works
import { Button } from "@/components/ui/button";
import { useAuth } from "@/hooks/use-auth";
You don't need to manually configure resolve.alias in your vite.config - lovite handles this for you.
When running locally (outside a Lovable sandbox), lovite only applies development mode enhancements (component tagger and sourcemaps in dev mode). Your server configuration is used exactly as written.
In sandbox mode, server settings are enforced for compatibility with Lovable's infrastructure.
// Local: uses port 3000, dev enhancements applied
// Sandbox: port overridden to 8080, dev enhancements applied
export default defineConfig({
server: {
port: 3000, // Used locally, overridden to 8080 in sandbox
},
});
lovite validates your configuration and warns about potential issues:
All server headers are removed in sandbox mode to prevent conflicts with Lovable's proxy infrastructure. If you configure any headers, lovite will warn you and they will be removed.
// This will warn in sandbox mode - headers are removed
export default defineConfig({
server: {
headers: {
'X-Custom-Header': 'value', // Will be removed in sandbox
'Cache-Control': 'no-cache', // Will be removed in sandbox
},
},
});
All proxy configurations are removed in sandbox mode. lovite validates and warns about potential issues before removal:
// These will warn and be removed in sandbox mode
export default defineConfig({
server: {
proxy: {
'/api': 'https://external-api.com', // External URL - will warn
'/ws': { target: 'ws://localhost:3001', ws: true }, // WebSocket - will warn
'/local': 'http://localhost:4000', // Even localhost proxies are removed
},
},
});
Note: In local development (outside sandbox), proxy configurations work normally. They are only removed when running in a Lovable sandbox environment.
Custom CORS configurations will be overridden in sandbox mode to ensure compatibility with Lovable's proxy. lovite will warn you if it detects custom CORS settings.
// This will warn in sandbox mode
export default defineConfig({
server: {
cors: { origin: 'https://example.com' }, // Will be overridden
},
});
defineConfig(config)Wraps Vite's defineConfig function. Accepts the same arguments and returns the same types:
defineConfig(config: UserConfig): UserConfigdefineConfig(config: Promise<UserConfig>): Promise<UserConfig>defineConfig(config: (env: ConfigEnv) => UserConfig): (env: ConfigEnv) => UserConfigdefineConfig(config: (env: ConfigEnv) => Promise<UserConfig>): (env: ConfigEnv) => Promise<UserConfig>lovite fully supports function-based configs:
export default defineConfig(({ mode }) => ({
plugins: [react()], // lovite automatically adds componentTagger() and configures sourcemaps in dev mode
}));
Async configurations are also supported:
export default defineConfig(async ({ mode }) => {
const data = await fetchSomeConfig();
return {
plugins: [react()],
define: data,
};
});
lovite is written in TypeScript and provides full type definitions. All Vite types are preserved, so you get the same IntelliSense and type checking as with Vite's native defineConfig.
import { defineConfig } from 'lovite';
import type { UserConfig } from 'vite';
// Full type inference and autocomplete
export default defineConfig({
server: {
port: 8080, // Autocomplete works
},
});
Lovable's sandbox environment runs your Vite dev server behind a proxy that:
lovite ensures your Vite config is compatible with this infrastructure without requiring manual configuration changes.
MIT
FAQs
Vite config wrapper for Lovable sandbox environments
The npm package @lovable.dev/lovite receives a total of 34 weekly downloads. As such, @lovable.dev/lovite popularity was classified as not popular.
We found that @lovable.dev/lovite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.