
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@75lb/deep-merge
Advanced tools
Deep-merge the values of one object structure into another. Similar to Object.assign() except it processes the full depth of the object structure, not only the top level. Useful for merging config.
import deepMerge from '@75lb/deep-merge'
Typical example merging four objects. Input:
deepMerge(
{ port: 8000, data: { animal: 'cow' } },
{ stack: ['one'] },
{ stack: ['two'], help: true },
{ data: { animal: 'bat', metal: 'iron' } }
)
Result
{
port: 8000,
stack: ['two'],
help: true,
data: { animal: 'bat', metal: 'iron' }
}
Empty arrays are ignored and not merged in. Input:
deepMerge(
{ stack: ['one'] },
{ stack: [] }
)
Result:
{ stack: ['one'] }
However, if the later array contains one or more values the later array will replace the original:
deepMerge(
{ stack: ['one'] },
{ stack: ['two'] }
)
Result:
{ stack: ['two'] }
This library is compatible with Node.js, the Web and any style of module loader. It can be loaded anywhere, natively without transpilation.
Within a Node.js ECMAScript Module:
import deepMerge from '@75lb/deep-merge'
Within an modern browser ECMAScript Module:
import deepMerge from './node_modules/@75lb/deep-merge/dist/index.mjs'
© 2018-24 Lloyd Brookes <75pound@gmail.com>.
Tested by test-runner. Documented by jsdoc-to-markdown.
Lodash's merge function is a popular utility for deep merging objects. It is part of the larger Lodash library, which provides a wide range of utility functions for JavaScript. Compared to @75lb/deep-merge, lodash.merge is more widely used and comes with the additional overhead of the entire Lodash library.
The deepmerge package is a standalone library specifically designed for deep merging objects. It is lightweight and focuses solely on merging, similar to @75lb/deep-merge. However, deepmerge has a larger user base and more frequent updates.
merge-deep is another package focused on deep merging objects. It offers similar functionality to @75lb/deep-merge but also includes options for customizing the merge behavior. It is a good alternative if you need more control over the merging process.
FAQs
Deep-merge the values of one object structure into another
We found that @75lb/deep-merge demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.