
Research
6 Malicious Packagist Themes Ship Trojanized jQuery and FUNNULL Redirect Payloads
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.
Microdiff is a tiny (<1kb), fast, zero dependency object and array comparison library. It is significantly faster than most other deep comparison libraries, and has full TypeScript support.
💡 I recommend reading this blog post:
Building the fastest object and array differ for an explanation of how Microdiff achieves its size and speed.
diff() functionnew Date() and new RegExp()First, install Microdiff
npm i microdiff
If you are using Deno, you can import it from Deno.land with the link https://deno.land/x/microdiff@VERSION/index.ts (remember to change @VERSION to the version you want to use).
After you install it, import it and run it on two objects.
import diff from "microdiff";
const obj1 = {
originalProperty: true,
};
const obj2 = {
originalProperty: true,
newProperty: "new",
};
console.log(diff(obj1, obj2));
// [{type: "CREATE", path: ["newProperty"], value: "new"}]
If you are using CommonJS, you can import it like this:
const diff = require("microdiff").default;
There are three different types of changes: CREATE, REMOVE, and CHANGE.
The path property gives a path to the property in the new object (or the old object in the case of REMOVE).
Each element in the paths is a key to the next property a level deeper until you get to the property changed, and it is a string or a number, depending on whether the object is an Array or Object (Objects with number keys will still be strings).
The value property exists in types CREATE and CHANGE, and it contains the value of the property added/changed/deleted.
The oldValue property exists in the type CHANGE and REMOVE, and it contains the old value of the property.
By default, Microdiff supports cyclical references, but if you are sure that the object has no cycles like parsed JSON, you can disable cycles using the cyclesFix option.
diff(obj1, obj2, { cyclesFix: false });
Geometric mean of time per operation relative to Microdiff (no cycles) (100%==equal time, lower is better)
microdiff (no cycles): 100%
microdiff: 149%
deep-diff: 197%
deep-object-diff: 288%
jsDiff: 1565%
These results are from a suite of benchmarks matching real world use cases of multiple open-source repos using various diffing algorithm, running under Node 22.12.0 on a Ryzen 7950x clocked at ~4.30 GHz. The benchmarks are run through mitata to minimize random variation and time most accurately. You can view the full benchmark code in bench.js and the benchmarks themselves at benchmarks/applied.
Of course, these benchmarks should be taken with a grain of salt due to the inherent errors present in benchmarking JavaScript, but if you want to run them on your own computer in your own runtime/setup, run bench.js.
Thanks for helping the project out! Contributing is pretty simple. Fork the repository (if you need more information on how to do this, check out this GitHub guide), clone it to your computer, and start programming! To compile the program, run npm run build (replace npm with pnpm or yarn if you are using one of those). This will create CommonJS and ESM modules in /dist.
To benchmark microdiff, you can run npm run bench. This will automatically build Microdiff and run a benchmarking program comparing microdiff to other common diffing libraries.
Finally, Microdiff has an extensive test suite which you should take advantage of. To make sure everything is working correctly, you can run npm run test. npm run test builds the project and then runs the entire test suite on the new version. If you are fixing a bug, be sure to add a test for that.
Also, make sure you read the Code of Conduct before contributing.
The deep-diff package provides similar functionality to microdiff, allowing you to find differences between two JavaScript objects. It supports nested objects and arrays, but it is generally larger and may not be as performant as microdiff.
The diff package is a more general-purpose diffing library that can be used to find differences between strings, arrays, and objects. It is more feature-rich than microdiff but also larger and potentially slower for object diffing.
The just-diff package is another lightweight library for diffing JavaScript objects. It is similar in size and performance to microdiff, but it may have a different API and feature set.
FAQs
Small, fast, zero dependency deep object and array comparison
The npm package microdiff receives a total of 444,028 weekly downloads. As such, microdiff popularity was classified as popular.
We found that microdiff demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.

Security News
The GCVE initiative operated by CIRCL has officially opened its publishing ecosystem, letting organizations issue and share vulnerability identifiers without routing through a central authority.

Security News
The project is retiring its odd/even release model in favor of a simpler annual cadence where every major version becomes LTS.