
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
composite-reducer
Advanced tools
Allows reducers for specific properties of a state - better organization for reducers of complex or deeply nested objects.
Works well with state management solutions such as Redux or React Context + useReducer hook.
Similar to the combineReducers function in redux. But instead of combining many equal top level reducers, has a main reducer and attaches other reducers for properties of the main state.
Say there is a state that looks like this:
{
name: "voiceflow",
type: "startup",
settings: {
website: "voiceflow.com"
}
}
If a reducer is created for this state, to change the website, I would need a dedicated action to update it, and construct a new state with something messier like this:
{
...state,
settings: {
...state.settings,
website: action.payload
}
}
With composite-reducer, the settings sub-state can be abstracted into it's own dedicated reducer, separate from the main one.
const reducer = compositeReducer(mainReducer, {
settings: settingsReducer
});
The dedicated reducer updates/works with a smaller, more concise state.
The main reducer can still act on the property if it has to.
Along with combinedReducer, this encourges the overall reducer to be cleaner/better organized.
import compositeReducer from 'composite-reducer';
const mainReducer = (state, action) => {
// do reducer stuff here
return state;
};
const propertyOneReducer = (state, action) => {
// state is in the shape of propertyOne
// do reducer stuff here
return state;
};
const propertyTwoReducer = (state, action) => {
// state is in the shape of propertyTwo
// do reducer stuff here
return state;
};
const reducer = compositeReducer(mainReducer, {
propertyOne: subpropertyOneReducer,
propertyTwo: subpropertyTwoReducer,
})
To use composite-reducer, install it as a dependency:
# If you use npm:
npm install composite-reducer
# Or if you use Yarn:
yarn add composite-reducer
This assumes that you’re using a package manager such as npm.
FAQs
combine reducers based on individual properties
The npm package composite-reducer receives a total of 0 weekly downloads. As such, composite-reducer popularity was classified as not popular.
We found that composite-reducer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.