
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
frozen-moment
Advanced tools
Immutability for Moment.js. Freeze moments so that mutation methods return copies instead of altering the original timestamp.
If you build large applications that use Moment.js, you've
probably
been
surprised
at some point by the mutability of moments. Things like moment.startOf("day")
change the date of your original moment (instead of returning a new moment).
Unfortunately, this leads to subtle bugs if you pass moments around and then
start to do math on them while expecting other places to still have the old
value.
Or maybe you're smarter than me, and yet you still
wish
that
Moment
had an
immutable
API.
It gets annoying to keep typing moment.clone() all the time.
Either way, this plugin is for you.
Frozen Moment is a plugin for Moment.js. With Frozen Moment, all of your normal moments will still work the same way they always have -- so you won't need to adopt immutability throughout your entire codebase all at once. Frozen Moment simply adds a new method to every moment instance:
moment().freeze()Returns a "frozen" copy of the original moment. "Frozen" moments will behave exactly like normal moments, but all of the methods that would normally change the value of a frozen moment will instead return a new frozen moment.
Basically, frozen moments will automatically call moment.clone() before you
try to call any of Moment's setters or
manipulation functions. You'll also
get a new instance every time you change a frozen moment's locale.
For performance and compatibility reasons, frozen moments are not made
immutable with Object.freeze. If you want to shoot yourself in the foot by
manually meddling with your frozen moment's internal data, go right ahead.
That said, frozen moments will be immutable as long as you only use Moment's
documented API methods.
Frozen moments attempt to play nice with other Moment.js plugins, assuming that
the Frozen Moment plugin is loaded last and/or moment.frozen.autowrap() is
called after the last Moment plugin has been initialized. That said, we cannot
guarantee that every plugin will behave correctly. If you have problems using
Frozen Moment with any other Moment plugin, please open an issue and we'll
work with the other plugin maintainer to resolve the incompatibility.
Frozen moments do not have the freeze() method -- only regular moments do.
frozenMoment.thaw()Returns a normal (un-frozen) copy of a frozen moment.
Regular old moments do not have a thaw() method -- only frozen moments do.
moment().isFrozen() / frozenMoment.isFrozen()Returns true if called on a frozen moment, and false if called on a
standard moment.
Note that moment.isMoment() will return true for frozen moments and normal
moments alike.
moment.frozen.fnThis is the prototype for all frozen moment instances. It inherits from
moment.fn, which is the prototype used for all Moment instances created by
the core library.
moment.frozen.unwrap(methodNames...)Removes all existing wrappers for the named moment prototype function(s), and
whitelists those method names so that wrappers will not be re-created by
subsequent calls to moment.frozen.autowrap(). This is a mechanism for
performance-optimizing plugin authors to whitelist methods that do not mutate
the moment instance, so that Frozen Moment will not automatically clone a new
instance every time those methods are invoked.
moment.frozen.autowrap()Re-generates wrappers for all functions on the Moment prototype that have not been explicitly whitelisted. Some plugin authors may want to call this after adding mutation methods to the Moment prototype, so that their users will not need to load their plugin before Frozen Moment. Alternatively, application authors may wish to call this after loading their Moment plugins, to ensure that all plugin methods are properly wrapped for immutable behavior.
Frozen Moment should generally work, and it has been used by a few folks in production applications. The current v0.4 release is a reasonably stable implementation of the core ideas. This code has inspired and informed Moment's implementation of immutability, which is coming in version 3.0.
Our maintainer is manually running our unit tests in a variety of browsers (IE 8 and the current releases of Chrome, Firefox, and Safari) to ensure broad runtime compatibility, in addition to our CI build with Node.
Pull requests are enthusiastically welcomed for improvements on our current to-do list. If you have other ideas for new features, it's often a good idea to get our feedback on your plans before you bother writing the code. In any event, please remember to submit unit tests to verify your changes.
The original version of Frozen Moment was a full-fledged fork of Moment.js. It is no longer maintained.
FAQs
Immutability for Moment.js. Freeze moments so that mutation methods return copies instead of altering the original timestamp.
The npm package frozen-moment receives a total of 531 weekly downloads. As such, frozen-moment popularity was classified as not popular.
We found that frozen-moment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.