
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@deepkit/bson
Advanced tools
@deepkit/bson is a high-performance TS implementation of a parser and serializer for BSON,
the MongoDB Binary JSON format. It's the fastest JS BSON parser, even faster than native JSON.parse/stringify.
Deepkit has reimplemented it because it's a high-performance framework and both the official JS (js-bson) and C++ (bson-ext) packages are too slow. How slow? When converting 10k elements in an array, js-bson takes 25ms, bson-ext takes 31ms, whiles JSON.parse takes only 5ms. This makes the official BSON parser 5x slower than native JSON.parse. deepkit/type-bson on the other hand takes only 2ms and is therefore 13x faster.
Parsing BSON buffer that contains an array with 10k objects.
| Method | Time (ms) |
|---|---|
| official native bson-ext | 31ms |
| official js-bson | 25ms |
| deepkit/bson generic v2 | 6ms |
| deepkit/bson generic v3 | 4ms |
| JSON.parse | 5ms |
| deepkit/type JIT | 2ms |
Serializing an array with 10k objects.
| Method | Time (ms) |
|---|---|
| official native bson-ext | 39ms |
| official js-bson | 33ms |
| JSON.stringify | 5ms |
| deepkit/bson JIT | 2ms |
"deepkit/bson JIT" means a parser/serializer based on a schema like so:
import {t} from '@deepkit/type';
import {getBSONDecoder} from '@deepkit/bson';
interface Model {
username: string;
tags: string[];
priority: number;
}
const decoder = getBSONDecoder<Model>();
const bson = new Buffer([]);
const document = decoder(bson);
whereas "deepkit/type generic" means schema-less:
import {parseObject, ParserV2, ParserV3} from '@deepkit/bson';
const bson = new Buffer([]);
const object1 = parseObject(new ParserV2(bson));
const object2 = parseObject(new ParserV3(bson));
There are a couple of differences to the official serializer.
1.0.19 (2025-09-22)
FAQs
Deepkit BSON parser
We found that @deepkit/bson demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.