
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
vite-plugin-tm-userscript
Advanced tools
English | 中文
Recommended to use vite-plugin-monkey
推荐使用功能更丰富的 vite-plugin-monkey
Tampermonkey userscript developing & build plugin based on vite.
tmHeader field in package.jsongrant when building for productiongrant by default in development mode, and add all grant methods to unsafeWindowrequire and automatically imported UNPKG CDN, see the plugin configuration below for detailsyarn add vite-plugin-tm-userscript -D
# OR
npm install vite-plugin-tm-userscript -D
vite.config.tsimport { defineConfig } from 'vite'
import Userscript from 'vite-plugin-tm-userscript'
// https://vitejs.dev/config/
export default defineConfig({
plugins: [
Userscript({
externalGlobals: ['vue']
})
]
})
There are five ways to configure Userscript Header, the priority is as follows
headersheader.config.jsonheader.config.jsheader.config.txttmHeader field in package.jsonAmong them, header.config.txt uses Tampermonkey header annotation configuration, will not be processed, directly inserted into the script header
The other four formats are configured in json format, and multiple attribute configurations such as match are represented by an array, and grant and require are automatically added after processing
See example/header.config.js for example configuration
For specific property configuration, see Tampermonkey Documentation
export interface TMPluginOptions {
entry?: string;
autoGrant?: boolean;
headers?: TmHeaderConfig;
externalGlobals?: string[] | Record<string, string | string[]>;
}
headersSee Configure Userscript Header
For example
// vite.config.js
import { defineConfig } from 'vite'
import Userscript from 'vite-plugin-tm-userscript'
export default defineConfig({
plugins: [
Userscript({
entry: 'main.js',
headers: {
name: 'Test',
namespace: 'https://www.nanoka.top',
author: 'asadahimeka',
description: 'No description',
source: 'https://github.com/asadahimeka/userscripts',
supportURL: 'https://github.com/asadahimeka/userscripts/issues',
license: 'MIT',
match: 'https://test.com/*',
require: 'https://lib.baomitu.com/arrive/2.4.1/arrive.min.js',
'run-at': 'document-start',
},
}),
],
})
externalGlobalsConfigure external packages, such as vue, axios, etc., to reduce the package size, and automatically declare require
Three configuration forms, CDN can be customized, if CDN is not configured, UNPKG CDN is used by default
// 1
Userscript({
externalGlobals: ['jquery']
})
// 2
Userscript({
externalGlobals: {
'jquery': 'jQuery'
}
})
// 3
Userscript({
externalGlobals: {
'jquery': ['jQuery', 'https://cdn.bootcdn.net/ajax/libs/jquery/3.6.0/jquery.min.js']
}
})
// =>
return {
rollupOptions: {
external: ['jquery']
output: {
globals: {
jquery: 'jQuery'
}
}
}
}
// @require https://cdn.bootcdn.net/ajax/libs/jquery/3.6.0/jquery.min.js
autoGrantboolean type, defaults to true
Automatically analyze the Tampermonkey grant used in the code and add it to the Userscript Header declaration
entryEntry file, default is src/main.js or src/main.ts
See the example folder
Production build mode will force the configuration of config.build:
name (required) attribute of the package name package.json to build, and the file name to build is also related to itiife, no compression, no separation of css filesrollupOptions to support other featuresIn development mode, the script of vite needs to be injected through the script tag. Some websites have enabled CSP(Content-Security-Policy), resulting in an error. You can install the Chrome plugin Disable Content-Security-Policy or Always Disable Content-Security-Policy, to disable CSP(Content-Security-Policy), open the plug-in during development (remember to close it at other times to ensure the security of web browsing).
Also, you can change Tampermonkey options(open extension://iikmkjmpaadaobahmlepeloendndfphd/options.html#nav=settings) at Security, set Modify existing content security policy (CSP) headers to Remove entirely (possibly unsecure).
Forked from vite-plugin-tampermonkey.
Licensed under the MIT license.
FAQs
A vite plugin to build userscripts mainly for Tampermonkey.
The npm package vite-plugin-tm-userscript receives a total of 5 weekly downloads. As such, vite-plugin-tm-userscript popularity was classified as not popular.
We found that vite-plugin-tm-userscript demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.