
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
vite-config-editor
Advanced tools
Fluent, idempotent edits to vite.config.ts via ts-morph
npm install --save-dev vite-config-editor
// update-vite-config.js
import { ViteConfigEditor } from 'vite-config-editor';
const editor = ViteConfigEditor.open('./vite.config.ts');
// Ensure defineConfig wrapper
editor.ensureDefineConfigWrap();
// Add plugins
editor.ensurePluginCall({
from: '@vitejs/plugin-react',
callee: 'react',
importKind: 'default',
args: { jsx: true },
});
// Set properties with type-safe methods
editor.setString('base', '/app/');
editor.setNumber('server.port', 5173);
editor.setBoolean('build.sourcemap', true);
// Save with optional formatting
await editor.save({ format: true });
Run the script:
node update-vite-config.js
export default defineConfig({...}), aliased defineConfig, and plain objectsensureDefaultImport(from: string, desiredLocal: string): stringReturns the actual local identifier used, avoiding duplicates when imports already exist.
const id = editor.ensureDefaultImport('@vitejs/plugin-react', 'customReact');
// Returns 'react' if already imported as 'react', otherwise 'customReact'
ensureNamedImport(from: string, name: string, alias?: string): stringeditor.ensureNamedImport('vite', 'defineConfig', 'dc');
// import { defineConfig as dc } from 'vite'
ensurePluginCall(spec: PluginSpec): ViteConfigEditorIntelligently adds plugins, detecting existing ones even with different import names.
editor.ensurePluginCall({
from: '@vitejs/plugin-vue',
callee: 'vue',
importKind: 'default',
args: { jsx: true },
});
removePluginCall(pluginName: string): ViteConfigEditoreditor.removePluginCall('react');
addToPluginArrayArg(pluginName: string, argPath: string, value: string, options?)Supports nested paths and insertion anchoring:
// Add to nested array
editor.addToPluginArrayArg('laravel', 'build.input', 'app.js');
// Insert after specific item
editor.addToPluginArrayArg('laravel', 'input', 'app.js', {
after: 'app.css',
});
editor.setString('base', '/app/');
editor.setBoolean('build.sourcemap', true);
editor.setNumber('server.port', 5173);
editor.mergeObject('resolve', { alias: { '@': '/src' } });
editor.addUniqueStringToArray('resolve.extensions', '.ts');
await editor.save({
format: true, // Format code (default: false)
organizeImports: true, // Organize imports (default: false)
preserveEOL: true, // Preserve line endings (default: true)
});
The library correctly handles existing imports with different names:
// Config has: import myReact from '@vitejs/plugin-react'
editor.ensurePluginCall({
from: '@vitejs/plugin-react',
callee: 'react',
importKind: 'default',
});
// Uses existing 'myReact', doesn't add duplicate import
Detects and preserves defineConfig aliases:
// Config has: import { defineConfig as dc } from 'vite'
// export default dc({ ... })
editor.ensureDefineConfigWrap(); // Correctly uses 'dc'
editor.consolidateImports();
// Before: import { a } from 'vite'; import { b } from 'vite';
// After: import { a, b } from 'vite';
Clear, actionable errors with context:
try {
ViteConfigEditor.open('./missing.ts');
} catch (error) {
// Cannot find config file at: ./missing.ts
// Working directory: /current/path
// Suggested path: /current/path/missing.ts
}
type PluginSpec = {
from: string; // Module to import from
callee: string; // Function to call
argsText?: string; // Raw arguments (default: "()")
importKind?: 'default' | 'named';
importAlias?: string; // Desired import alias
args?: any; // Arguments object
};
type FormatOptions = {
format?: boolean; // Format file
organizeImports?: boolean; // Organize imports
preserveEOL?: boolean; // Preserve line endings
};
FAQs
Fluent, idempotent edits to vite.config.ts via ts-morph
We found that vite-config-editor demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.