
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
A minimal static site generator built with Vite and the Vento templating engine.
A minimal static site generator built with Vite and the Vento templating engine.
Vitto combines the speed of Vite's development experience with the simplicity of Vento templates to create a modern static site generator. Perfect for documentation sites, blogs, portfolios, and any project that needs fast builds and flexible templating without the complexity of larger frameworks.
Get started quickly using create-vitto to scaffold your project.
Visit the project page for more detailed information.
# Install with pnpm
pnpm add -D vitto
# Install with npm
npm install --save-dev vitto
# Install with yarn
yarn add --dev vitto
import { defineConfig } from 'vite'
import vitto from 'vitto'
export default defineConfig({
plugins: [
vitto({
minify: process.env.NODE_ENV === 'production',
enableSearchIndex: true,
metadata: {
siteName: 'Vitto',
title: 'Vitto - Static Site Generator Powered by Vite & Vento',
}
})
],
})
Licensed under the MIT license.
Copyrights in this project are retained by their contributors.
See the LICENSE file for more information.
FAQs
A minimal static site generator built with Vite and the Vento templating engine.
The npm package vitto receives a total of 2 weekly downloads. As such, vitto popularity was classified as not popular.
We found that vitto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.