
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
object-deep-merge
Advanced tools
Strongly-typed deep and recursive object merging. Considers all nested levels of objects, arrays, sets and maps.
Strongly-typed deep and recursive object merging with support for all value types.
pnpm add object-deep-merge
yarn add object-deep-merge
npm install object-deep-merge
import { merge } from "object-deep-merge";
const merged = merge({ foo: false }, { bar: true });
console.log({ merged });
{
"merged": {
"foo": false,
"bar": true
}
}
merge Type SignatureThe merge function accepts two optional type generics. TData and TResult.
function merge<TData extends MergeableObject = MergeableObject, TResult extends MergeableObject = TData>(
source: TData,
target: TData,
...targets: Array<TData>
): TResult;
[!IMPORTANT]
TheMergeandMergeDeeptypes fromtype-festare shipped from this library as a convenience. It is not unreasonable to use those types directly instead.
Without explicitly passing in types the function will infer the shape of the object(s) passed in.
TData will validate the shape of the objects passed in.TResult will override the output type. While this should be used sparingly, it provides a convenient approach for correctly typing partial types into complete types.type Data = {
name: string;
description: string;
};
const base: Data = { name: "object-deep-merge", description: "merge objects" };
const overrides: Partial<Data> = { description: "merge objects, deeply" };
const merged = merge(base, overrides);
// Type is inferred so the signature becomes:
// function merge<Partial<Data>, Partial<Data>>(source: Partial<Data>, target: Partial<Data>, ...targets: Partial<Data>[]): Partial<Data>
// TData = Partial<Data>
// TResult = Data
console.log({ merged });
{
"merged": {
"name": "object-deep-merge",
"description": "merge objects, deeply"
}
}
TData Generic[!NOTE] Passing in TData will validate the shape of the objects passed in.
type Data = {
name: string;
description: string;
};
const base: Data = { name: "object-deep-merge", description: "merge objects" };
const overrides: Partial<Data> = { description: "merge objects, deeply" };
const merged: Partial<Data> = merge<Partial<Data>>(base, overrides);
// TData = Partial<Data>
// TResult = Data
console.log({ merged });
{
"merged": {
"name": "object-deep-merge",
"description": "merge objects, deeply"
}
}
TData and TResult Generics[!NOTE] Passing in
TResultwill override the output type. While this should be used sparingly, it provides a convenient approach for correctly typing partial types into complete types.
type Data = {
name: string;
description: string;
};
const base: Data = { name: "object-deep-merge", description: "merge objects" };
const overrides: Partial<Data> = { description: "merge objects, deeply" };
const merged: Data = merge<Partial<Data>, Data>(base, overrides);
// TData = Partial<Data>
// TResult = Data
console.log({ merged });
{
"merged": {
"name": "object-deep-merge",
"description": "merge objects, deeply"
}
}
FAQs
Strongly-typed deep and recursive object merging. Considers all nested levels of objects, arrays, sets and maps.
We found that object-deep-merge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.