In module context. Then

    var config = require("settings.js");

My reasoning is that if you have access to change config or source code, all bets are off.

Or you could parse the config in a separate vm and import the result as JSON.