Bug report

What is the current behavior?

We collect a bunch of secrets into an object and pass them into Typescript with the DefinePlugin:

const secrets = Object.assign({}, locals, defaults);

const config = {
   ...
    devtool: "source-map",
    resolve: {
      extensions: [".ts", ".tsx", ".js", ".jsx"],
      fallback: {
        crypto: false
      }
    },
    module: { ... },
    plugins: [
      new CKEditorWebpackPlugin({language: "en"}),
      new webpack.DefinePlugin({
        secrets: secrets
      })
    ],
   entry: {
      app: "./src/frontend/ts/main.tsx"
    },
    output: {
      path: path.join(__dirname, "public/js"),
      publicPath: "js/",
      filename: "[name].js",
      chunkFilename: "[name].js"
    },
    externals: {
      "react": "React",
      "react-dom": "ReactDOM"
    }
  };

And then refer to them individually like:

pushManager.subscribe({
      userVisibleOnly: true,
      applicationServerKey: secrets.VAPID_PUB_KEY
});

But, if a given property like VAPID_PUB_KEY, is missing, the entire secrets object is substituted in place of
just the secrets part of the expression, so that it ends up producing:

pushManager.subscribe({
      userVisibleOnly: true,
      applicationServerKey:  {  ...  }.VAPID_PUB_KEY
});

What is the expected behavior?

I would expect either an error to be thrown or for nothing to be substituted in the place.

I hope I don't have to express the potential for this to expose data that was never intended to be included in public javascript.

Other relevant information:
webpack version: 5.70.0
Node.js version: v16.13.0
Operating System: MacOS 12.1, Ubuntu 20.04