Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The clone npm package is a utility for cloning JavaScript objects. It can create deep copies of objects, arrays, dates, and other types, ensuring that changes to the cloned object do not affect the original. It is useful when you need to work with copies of data without altering the original source.
Cloning objects
This feature allows you to create a deep copy of an object, so that changes to the cloned object do not affect the original object.
{"const clone = require('clone');
const obj = { a: 1, b: { c: 2 } };
const objClone = clone(obj);
console.log(objClone); // { a: 1, b: { c: 2 } }
objClone.b.c = 3;
console.log(obj.b.c); // 2, original object is not affected"}
Cloning arrays
This feature allows you to create a deep copy of an array, including any nested arrays, without affecting the original array.
{"const clone = require('clone');
const arr = [1, 2, [3, 4]];
const arrClone = clone(arr);
console.log(arrClone); // [1, 2, [3, 4]]
arrClone[2][0] = 5;
console.log(arr[2][0]); // 3, original array is not affected"}
Cloning dates
This feature allows you to clone Date objects, creating a new instance that represents the same moment in time as the original.
{"const clone = require('clone');
const date = new Date();
const dateClone = clone(date);
console.log(dateClone); // date object representing the same moment in time
console.log(date === dateClone); // false, they are different instances"}
lodash.clonedeep is a method from the Lodash library that provides deep cloning of objects and arrays. It is similar to clone but is part of a larger utility library that offers a wide range of functions for manipulating and traversing data.
deep-copy is another npm package that offers deep cloning functionality. It supports cloning of complex objects, including those with circular references. It is similar to clone but also handles functions and symbols, which clone does not.
rfdc (Really Fast Deep Clone) is a package that focuses on performance for deep cloning objects and arrays. It claims to be faster than other deep cloning methods, especially for large objects. Unlike clone, rfdc does not support cloning of functions, dates, regexes, maps, sets, blobs, filelists, image data, or array buffers.
offers foolproof deep cloning of objects, arrays, numbers, strings etc. in JavaScript.
npm install clone
(It also works with browserify, ender or standalone.)
var clone = require('clone');
var a, b;
a = { foo: { bar: 'baz' } }; // initial value of a
b = clone(a); // clone a -> b
a.foo.bar = 'foo'; // change a
console.log(a); // show a
console.log(b); // show b
This will print:
{ foo: { bar: 'foo' } }
{ foo: { bar: 'baz' } }
clone masters cloning simple objects (even with custom prototype), arrays, Date objects, and RegExp objects. Everything is cloned recursively, so that you can clone dates in arrays in objects, for example.
clone(val, circular, depth)
val
-- the value that you want to clone, any type allowed
circular
-- boolean
Call clone
with circular
set to false
if you are certain that obj
contains no circular references. This will give better performance if needed.
There is no error if undefined
or null
is passed as obj
.
depth
-- depth to which the object is to be cloned (optional,
defaults to infinity)
clone.clonePrototype(obj)
obj
-- the object that you want to cloneDoes a prototype clone as described by Oran Looney.
var a, b;
a = { hello: 'world' };
a.myself = a;
b = clone(a);
console.log(b);
This will print:
{ hello: "world", myself: [Circular] }
So, b.myself
points to b
, not a
. Neat!
npm test
Some special objects like a socket or process.stdout
/stderr
are known to not
be cloneable. If you find other objects that cannot be cloned, please open an
issue.
If you encounter any bugs or issues, feel free to open an issue at github or send me an email to paul@vorba.ch. I also always like to hear from you, if you’re using my code.
Copyright © 2011-2015 Paul Vorbach and contributors.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
deep cloning of objects and arrays
The npm package clone receives a total of 21,790,950 weekly downloads. As such, clone popularity was classified as popular.
We found that clone demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.