Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
The merge npm package is a utility that allows you to merge multiple objects into one. It is useful when you want to combine configurations, settings, or other data structures in JavaScript. It performs a deep merge by default, meaning that it recursively merges properties of objects, but it can also be configured to perform a shallow merge.
Deep Merge
This feature allows for the deep merging of objects, meaning that nested objects will also be merged together. The code sample demonstrates merging two objects with nested properties.
{"const merge = require('merge');
const object1 = { a: 1, b: { c: 2 } };
const object2 = { b: { d: 3 }, e: 4 };
const mergedObject = merge(object1, object2);
console.log(mergedObject); // Output: { a: 1, b: { c: 2, d: 3 }, e: 4 }"}
Shallow Merge
This feature allows for the shallow merging of objects, which means that it will not recursively merge nested objects. The code sample demonstrates merging two objects without combining the nested properties.
{"const merge = require('merge');
const object1 = { a: 1, b: { c: 2 } };
const object2 = { b: { d: 3 }, e: 4 };
const mergedObject = merge.recursive(false, object1, object2);
console.log(mergedObject); // Output: { a: 1, b: { d: 3 }, e: 4 }"}
Lodash's merge function is similar to merge, offering deep merge capabilities. It is part of the larger Lodash library, which provides a wide range of utility functions for working with arrays, numbers, objects, strings, etc. Lodash is well-known for its performance and reliability.
Deepmerge is another npm package that provides deep merge functionality. It is designed to be more flexible than merge, allowing for custom merge strategies for specific fields and handling of arrays and other types that merge might not support out of the box.
Extend is a jQuery-inspired package that can perform both deep and shallow merges. It is lightweight and straightforward, but it does not offer as much control over the merge process as merge or deepmerge.
Object-assign is a polyfill for the Object.assign method, which performs a shallow merge of objects. It is built to match the ES6 specification for Object.assign and is useful for simple merging tasks where deep merge is not required.
(recursive)? merging of (cloned)? objects.
npm i merge
import merge from 'merge'
<script src="https://cdn.jsdelivr.net/gh/yeikos/js.merge/dist/merge.browser.min.js"></script>
window.merge
merge(clone: boolean, ...items: Object[])
merge(...items: Object[])
merge.recursive(clone: boolean, ...items: Object[])
merge.recursive(...items: Object[])
// Merge
{
var objectA = {}
merge(objectA,
{ value: 1 },
{ str: 'hello world' }
)
var objectB = merge(true, objectA,
{ value: 2 }
)
objectA // { value: 1, str: 'hello world' }
objectB // { value: 2, str: 'hello world' }
}
// Recursive merge
{
var objectA = {}
merge.recursive(objectA,
{ level: { value: 1 } },
{ level: { str: 'hello world' } }
)
var objectB = merge.recursive(true, objectA,
{ level: { value: 2 } }
)
objectA.level // { value: 1, str: 'hello world' }
objectB.level // { value: 2, str: 'hello world' }
}
npm test
./dist/merge.browser.test.html
FAQs
(recursive)? merging of (cloned)? objects.
The npm package merge receives a total of 1,705,326 weekly downloads. As such, merge popularity was classified as popular.
We found that merge demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.