
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
vite-dead-code
Advanced tools
pnpm add vite-dead-code
import { defineConfig } from 'vite'
import { deadCode } from 'vite-dead-code'
export default defineConfig({
plugins: [deadCode({
replaceValues: {
yourKey: true
},
stripConsole: false, // strip `console` entirely
stripConsoleLevel: 'off' // strip up to `console.LEVEL`
})]
})
Understanding how the plugin works is pretty important when you use it, so here's an overview of what it does.
replaceValues that can be replaced in code with boolean literals (only inside if statements)
stripConsole: If true we strip any console usages in its entirety (may have unintended side effects)stripConsoleLevel: If stripConsole is false we can use this to only skip console logging up to a certain level (inclusive) off, log, info, warn, errorif statements in your code, any statements that consist only of boolean literals are evaluated to either true or false
true: Keep the code within the if statement, removing any else or else if that follows it as wellfalse: Remove the if statement, and if it has an else statement use that, if it has an else if statement continue to parse it as well// If replaceValues.keepMe = true and stripConsoleLevel = 'log'
if (!!keepMe && true) {
console.warn('Keep me')
console.log('Remove me')
} else {
console.log('Remove me')
}
// Becomes
{
console.warn('Keep me')
}
Optional replaceValues: Record<string, boolean>default: {}
Sets the values to replace.
deadCode({
replaceValues: {
keepMe: true,
debug: process.env.NODE_ENV === 'development'
},
})
Optional stripConsole: booleandefault: false
Strips all console uses. Note that it doesn't just strip the logging related entries, it strips anything that uses console, which can have unintended side effects. If you just want to remove logging use stripConsoleLevel: 'error' instead.
deadCode({
stripConsole: true
})
Optional stripConsoleLevel: stringdefault: off
This will strip all entries up to and including warn, leaving only error in your final output. Note that if you set stripConsole: true then this option is never used since if you strip the console in its entirety there's no point in checking which level to strip.
deadCode({
stripConsoleLevel: 'warn'
})
FAQs
Dead code removal for Vite
We found that vite-dead-code demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.