In module context. Then var config = require("settings.js"); My reasoning is that if you have access to change config or source code, all bets are off. O

In module context. Then var config = require("settings.js"); My reasoning is that if you have access to change config or source code, all bets are off. Or you could parse the config in a separate vm and import the result as JSON.