
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Type-safe, generic immutable datastructure for Typescript. Does not require manually setting JS paths ["a", "b", "c"] and allows TS autocompleted drilldown.
interface IA {
id: number;
name: string;
}
let a1 = makeImmutable<IA>({
id: 42,
name: "foo"
});
let a2 = a1.__set(x => x.id, 23);
// a1 !== a2 => true
let a3 = a2.__set(x => x.id, "23"); // Results in compiler error, string cannot be assigned to number
interface IA {
id: number;
name: string;
}
interface IB {
a1: IA;
a2: IA;
}
interface IC {
b: IB;
}
let c = makeImmutable<IC>({
b: {
a1: {
id: 42,
name: "foo"
},
a2: {
id: 23,
name: "bar"
}
}
});
let c2 = c.__set(x => x.b.a1, x => ({
...x,
id: 23
}));
// c2.b.a1.id === 23 => true
// c2.b.a1.name === "foo" => true
The integration is most valuable when used with a nested object:
interface IA {
id: number;
name: string;
}
interface IB {
a1: IA;
a2: IA;
}
interface IC {
b: IB;
}
let c = makeImmutable<IC>({
b: {
a1: {
id: 42,
name: "foo"
},
a2: {
id: 23,
name: "bar"
}
}
});
let c2 = c.__set(x => x.b.a1.id, 12);
// c !== c2 => true
// c.b.a2 === c2.b.a2 => true
// c.b.a1 !== c2.b.a1 => true
when you execute this:
let c2 = c.__set(x => x.b.a1.id, 12);
the root, b, and a1 will be automatically cloned, before the new id is assigned to a1. And again, everything is type-safe, something like
let c4 = c.__set(x => x.b.a1.id, "12");
would result in a compiler error, because the types of id and "12" do not match.
const c1 = makeImmutable({
foo: {
"a": 42,
"b": 23
}
});
const c2 = c.__set(x => x.foo, x => ({
...x,
"c": 11
}));
// c1.foo !== c2.foo => true
// c2.foo deep equals { "a": 42, "b": 23, "c": 11 }
const c1 = makeImmutable({
foo: {
"a": 42,
"b": 23
}
});
// Remove b
const p = "b";
const c2 = c.__set(x => x.foo, ({ [p], ...r }) => r);
// c1.foo !== c2.foo => true
// c2.foo deep equals { "a": 42 }
immuts includes a few helpers for common array operations, returning new versions of the modified arrays: push, pop, splice, remove.
const c1 = makeImmutable({
foo: [1, 2]
});
const c2 = c1.__set(x => x.foo, x => push(x, 3));
// c2.foo !== c1.foo
// c2.foo deep equals [1,2,3]
const c3 = c2.__set(x => x.foo, x => remove(x, 1));
// c3.foo !== c2.foo
// c3.foo deep equals [1,3]
undefinedTo build up the property path (i.__set(x => x.a.b.c) needs to be captured into ["a", "b", "c"]) the library relies on the ES6 Proxy object. In browsers where this is not suppored (mainly all versions of Internet Explorer) a fallback is used using Object.defineProperty.
This method does not deal correctly with optional properties, so something like this:
interface IA {
foo?: string;
bar: number;
}
let i = new Immutable<IA>({
// foo: "test", - leave undefined!
bar: 42
});
i.__set(x => x.foo, "test2");
would fail because foo did not exist at the time of creation. If you don't target Internet Explorer this will not be an issue and everything should work just fine, otherwise do not use optional properties, initialize to null.
FAQs
Simple, type-safe immutable data structure for Typescript
We found that immuts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.