
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
worker-timers
Advanced tools
A replacement for setInterval() and setTimeout() which works in unfocused windows.
A replacement for setInterval() and setTimeout() which works in unfocused windows.
For scripts that rely on WindowTimers like setInterval() or setTimeout() things get confusing when the site which the script is running on loses focus. Chrome, Firefox and maybe others throttle the frequency at which they invoke those timers to a maximum of once per second in such a situation. However this is only true for the main thread and does not affect the behavior of Web Workers. Therefore it is possible to avoid the throttling by using a worker to do the actual scheduling. This is exactly what worker-timers does.
worker-timers is available as a package on npm. Run the following command to install it:
npm install worker-timers
You can then import the exported functions in your code like this:
import { clearInterval, clearTimeout, setInterval, setTimeout } from 'worker-timers';
The usage is exactly the same (despite of the error handling and the differentiation between intervals and timeouts) as with the corresponding functions on the global scope.
const intervalId = setInterval(() => {
// do something many times
}, 100);
clearInterval(intervalId);
const timeoutId = setTimeout(() => {
// do something once
}, 100);
clearTimeout(timeoutId);
The native WindowTimers only maintain a single list of timers. But worker-timers maintains two separate lists to store the ids of intervals and timeouts internally. WindowTimers allows intervals to be cancelled by calling clearTimeout() and the other way round because it stores all timers in a single list. This is not possible with worker-timers.
const periodicWork = () => {};
// This will stop the interval.
const windowId = window.setInterval(periodicWork, 100);
window.clearTimeout(windowId);
// This will not cancel the interval. It may cancel a timeout.
const workerId = setInterval(periodicWork, 100);
clearTimeout(workerId);
This package is intended to be used in the browser and requires the browser to have support for Web Workers. It does not contain any fallback which would allow it to run in another environment like Node.js which doesn't know about Web Workers. This is to prevent this package from silently failing in an unsupported browser. But it also means that it needs to be replaced when used in a web project which also supports server-side rendering. The replacement should be straightforward, at least in theory, because each function has the exact same signature as its corresponding builtin function. But the configuration of a real-life project can be tricky. For a concrete example, please have a look at the worker-timers-ssr-example provided by @newyork-anthonyng. It shows the usage inside of a server-side rendered React app.
If worker-timers is used inside of an Angular app and Zone.js (which is the default) is used to detect changes, the behavior of worker-timers can be confusing. Angular is using Zone.js which is patching the native setInterval() and setTimeout() functions to get notified about the invocation of their callback functions. But Angular (more specifically Zone.js) is not aware of worker-timers and doesn't get notified about any callback invocations. Therefore Angular needs to be notified manually about state changes that occur inside of a callback function which was scheduled with the help of worker-timers.
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
The worker-timer package provides similar functionality by running timer functions in Web Workers. It aims to provide more accurate timing and less interference from the main thread, similar to worker-timers.
FAQs
A replacement for setInterval() and setTimeout() which works in unfocused windows.
The npm package worker-timers receives a total of 299,600 weekly downloads. As such, worker-timers popularity was classified as popular.
We found that worker-timers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.