
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
object-compare-2
Advanced tools
A TypeScript utility for comparing objects and detecting changes between them. This package provides robust object comparison with support for deep comparison, custom comparators, and field filtering.
npm install object-compare-2
# or
yarn add object-compare-2
# or
pnpm add object-compare-2
import { getChangedFields, hasChanges } from "object-compare-2";
const original = {
name: "John",
age: 30,
address: {
street: "Main St",
city: "Boston",
},
tags: ["user", "admin"],
};
const current = {
name: "John",
age: 31,
address: {
street: "Main St",
city: "New York",
},
tags: ["user", "admin", "manager"],
};
// Get changed fields
const changes = getChangedFields(current, original);
console.log(changes);
// Output:
// {
// age: 31,
// address: { street: 'Main St', city: 'New York' },
// tags: ['user', 'admin', 'manager']
// }
// Check if there are any changes
const hasAnyChanges = hasChanges(current, original);
console.log(hasAnyChanges); // true
interface User {
name: string;
age: number;
address: {
street: string;
city: string;
country: string;
};
lastLogin: Date;
permissions: string[];
}
const current: User = {
name: "John",
age: 30,
address: {
street: "Main St",
city: "Boston",
country: "USA",
},
lastLogin: new Date("2024-01-01"),
permissions: ["read", "write"],
};
const original: User = {
name: "John",
age: 30,
address: {
street: "Second St",
city: "Boston",
country: "USA",
},
lastLogin: new Date("2024-01-02"),
permissions: ["read"],
};
const changes = getChangedFields(current, original, {
customComparators: {
// Only compare city and country for address
address: (curr, orig) =>
curr.city === orig.city && curr.country === orig.country,
// Compare dates ignoring time
lastLogin: (curr, orig) => curr.toDateString() === orig.toDateString(),
// Check if arrays have same length
permissions: (curr, orig) => curr.length === orig.length,
},
});
const changes = getChangedFields(current, original, {
ignoreFields: ["lastLogin", "permissions"], // These fields will be ignored in comparison
});
const current = {
name: "John",
age: null,
title: undefined,
};
const original = {
name: "John",
age: 30,
title: "Developer",
};
// Include null/undefined changes
const changes1 = getChangedFields(current, original, {
includeNullish: true,
});
// Output: { age: null, title: undefined }
// Exclude null/undefined changes
const changes2 = getChangedFields(current, original, {
includeNullish: false,
});
// Output: {}
const changes = getChangedFields(current, original, {
deep: false, // Only compare object references
});
getChangedFields<T>Gets the changed fields between two objects by comparing their values.
function getChangedFields<T extends Record<string, any>>(
currentValue: T,
originalValue: T,
options?: CompareOptions<T>
): Partial<T>;
interface CompareOptions<T> {
/**
* If true, includes fields that changed to undefined/null
* If false, omits fields that changed to undefined/null
* @default false
*/
includeNullish?: boolean;
/**
* Custom comparison function for specific fields
*/
customComparators?: {
[K in keyof T]?: (current: T[K], original: T[K]) => boolean;
};
/**
* If true, performs deep comparison of objects and arrays
* If false, performs shallow comparison
* @default true
*/
deep?: boolean;
/**
* Fields to ignore during comparison
*/
ignoreFields?: Array<keyof T>;
}
hasChanges<T>Checks if an object has any changes compared to its original state.
function hasChanges<T extends Record<string, any>>(
currentValue: T,
originalValue: T,
options?: CompareOptions<T>
): boolean;
The package is written in TypeScript and includes type definitions. It provides full type inference for your objects and custom comparators.
MIT
Contributions are welcome! Please feel free to submit a Pull Request.
FAQs
A TypeScript utility for comparing objects and detecting changes
We found that object-compare-2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.