Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Uniquely flexible and light-weight utility for deep (recursive) merging/cloning of JavaScript objects. Provides advanced options for customizing the merge/clone process: inspect, filter, and modify keys and properties; merge or skip unique, common, and un
Mergician is a uniquely flexible and light-weight utility for deep (recursive) merging/cloning of JavaScript objects.
Unlike native methods and other merge/clone utilities, Mergician provides advanced options for customizing the merge/clone process. These options make it easy to inspect, filter, and modify keys and properties; merge or skip unique, common, and universal keys (i.e., intersections, unions, and differences); and merge, sort, and remove duplicates from arrays. Property accessors and descriptors are also handled properly, ensuring that getter/setter functions are retained and descriptor values are defined on new merged/cloned objects.
Basic object cloning using default options:
// ES module shown. CommonJS module also available (see below).
import mergician from 'mergician';
const obj1 = { a: [1, 1], b: { c: 1, d: 1 } };
const clonedObj = mergician({}, obj1);
// Results
console.log(clonedObj); // { a: [1, 1], b: { c: 1, d: 1 } }
console.log(clonedObj === obj1); // false
console.log(clonedObj.a === obj1.a); // false
console.log(clonedObj.b === obj1.b); // false
Advanced object merging using custom options:
// ES module shown. CommonJS module also available (see below).
import mergician from 'mergician';
const obj1 = { a: [1, 1], b: { c: 1, d: 1 } };
const obj2 = { a: [2, 2], b: { c: 2 } };
const obj3 = { e: 3 };
const mergedObj = mergician({
skipKeys: ['d'],
appendArrays: true,
dedupArrays: true,
filter({ depth, key, srcObj, srcVal, targetObj, targetVal }) {
if (key === 'e') {
targetObj['hello'] = 'world';
return false;
}
}
})(obj1, obj2, obj3);
// Result
console.log(mergedObj); // { a: [1, 2], b: { c: 2 }, hello: 'world' }
Platform Support
Node 10+
Chrome 61+
Edge 16+
Firefox 60+
Safari 10.1+
NPM
npm install mergician
// ES module
import mergician from 'mergician';
// CommonJS module
const mergician = require('mergician');
CDN
Available on jsdelivr (below), unpkg, and other CDN services that auto-publish npm packages.
// ES module @ latest v1.x.x (see @ version in URL)
import mergician from 'https://cdn.jsdelivr.net/npm/mergician@1/dist/mergician.min.mjs';
<!-- Global "mergician" @ latest v1.x.x (see @ version in URL) -->
<script src="https://cdn.jsdelivr.net/npm/mergician@1/dist/mergician.min.js"></script>
💡 Note the
@
version lock in the URLs above. This prevents breaking changes in future releases from affecting your project and is therefore the safest method of loading dependencies from a CDN. When a new major version is released, you will need to manually update your CDN URLs by changing the version after the@
symbol.
See the documentation site for details.
A sponsorship is more than just a way to show appreciation for the open-source authors and projects we rely on; it can be the spark that ignites the next big idea, the inspiration to create something new, and the motivation to share so that others may benefit.
If you benefit from this project, please consider lending your support and encouraging future efforts by becoming a sponsor.
Thank you! 🙏🏻
This project is licensed under the MIT license.
Copyright (c) John Hildenbiddle (@jhildenbiddle)
1.1.0
2023-02-23
invokeGetters
optionskipSetters
optionhoistProto
option</script>
tag in docsFAQs
Uniquely flexible and light-weight utility for cloning and deep (recursive) merging of JavaScript objects. Supports descriptor values, accessor functions, and custom prototypes. Provides advanced options for customizing the clone/merge process.
The npm package mergician receives a total of 8,097 weekly downloads. As such, mergician popularity was classified as popular.
We found that mergician demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.