Earlier quoted context omitted.
I load config files as JS (not JSON). And only use JSON for data serialization. In plain JS you can have comments and dont have to put quotes around properties. Not saying everyone should have a full JS parser for their config files, but its really nice.
So you're running eval on your config data? Not feasible for external data.
var config = require("settings.js");
My reasoning is that if you have access to change config or source code, all bets are off.Or you could parse the config in a separate vm and import the result as JSON.