
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
IterableWeakSet, IterableWeakMap, and WeakValueMap provide iterable weak collections whose entries disappear automatically when their objects are garbage collected—perfect for caches and registries in any JavaScript runtime.
This library provides three iterable weak data structures for JavaScript, IterableWeakSet, IterableWeakMap, and WeakValueMap. They keep only weak references to their keys or values, so entries disappear automatically once the referenced objects are garbage collected instead of blocking GC.
import {
IterableWeakMap,
IterableWeakSet,
WeakValueMap,
} from "@denostack/weakref";
const set = new IterableWeakSet();
const map = new IterableWeakMap();
const weakValueMap = new WeakValueMap();
Install
npm install weakref
import { IterableWeakMap, IterableWeakSet, WeakValueMap } from "weakref";
[!NOTE] Examples below call
globalThis.gc?.()only to symbolize “a GC cycle just finished”. Manual GC is available only when the runtime exposes it (e.g. Node.js started with--expose-gc); otherwise entries disappear the next time the runtime notifies theFinalizationRegistry.
IterableWeakSet implements the semantics of both WeakSet (weak keys) and Set (iteration helpers) so you can keep a deduplicated collection of objects without preventing them from being garbage collected. Once an object is collected, the entry is removed automatically.
Interface
class IterableWeakSet<T extends object> implements WeakSet<T>, Set<T> {
constructor(values?: readonly T[] | null);
constructor(iterable: Iterable<T>);
}
Example
const set = new IterableWeakSet();
// create an object with a weak reference
{
const user = { id: 1, email: "hey@wan2.land" };
set.add(user);
}
// end of scope, user will be garbage collected
// ...later, after a GC cycle (optional manual trigger shown here)
globalThis.gc?.(); // Node needs --expose-gc
// check the set size
console.log(set.size); // output: 0
IterableWeakMap combines a WeakMap with iterable Map helpers so you can inspect entries without blocking GC. Keys are weakly referenced and disappear once they are no longer referenced elsewhere.
Interface
class IterableWeakMap<K extends object, V> implements WeakMap<K, V>, Map<K, V> {
constructor(entries?: readonly (readonly [K, V])[] | null);
constructor(iterable: Iterable<readonly [K, V]>);
}
Example
const map = new IterableWeakMap();
// create an object with a weak reference
{
const user = { id: 1, email: "hey@wan2.land" };
const metadata = { created: new Date() };
map.set(user, metadata);
}
// end of scope, user will be garbage collected
// ...later, after a GC cycle (optional manual trigger shown here)
globalThis.gc?.(); // Node needs --expose-gc
// check the map size
console.log(map.size); // output: 0
WeakValueMap is a class that allows you to create a map of non-object keys with weak references to object values. It is useful when primitive identifiers are used to look up objects that should be collected when no longer referenced elsewhere.
Interface
class WeakValueMap<K, V extends object> implements Map<K, V> {
constructor(entries?: readonly (readonly [K, V])[] | null);
constructor(iterable: Iterable<readonly [K, V]>);
}
Example
const map = new WeakValueMap();
// create an object with a weak reference
{
const user = { id: 1, email: "hey@wan2.land" };
map.set(user.id, user);
}
// end of scope, user will be garbage collected
// ...later, after a GC cycle (optional manual trigger shown here)
globalThis.gc?.(); // Node needs --expose-gc
// check the map size
console.log(map.size); // output: 0
[!TIP] Methods like
get(),has(), and iterators (entries(),keys(),values(),forEach(),for...of) check the underlyingWeakRefon access and automatically skip (or clean up) entries whose values have already been garbage-collected.However, the
sizeproperty reflects the internal map's count and may temporarily include stale entries until theFinalizationRegistrycallback runs. If you need an exact count of live entries, use[...map.values()].lengthinstead.
FAQs
IterableWeakSet, IterableWeakMap, and WeakValueMap provide iterable weak collections whose entries disappear automatically when their objects are garbage collected—perfect for caches and registries in any JavaScript runtime.
We found that weakref demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.