
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
null-prototype-object
Advanced tools
A minimal utility for creating objects with a
nullprototype using a reusable constructor.
Object.create(null)Object.create(null) gives you a clean object with no prototype — useful for:
toString, hasOwnProperty, etc.)But there's a performance cost in high-frequency scenarios.
Each call to Object.create(null) creates a new object shape (hidden class).
JavaScript engines like V8 can't optimize repeated use because:
null-prototype-objectThis package provides a constructor with a frozen, shared null-prototype, enabling V8 to:
| Feature | Object.create(null) | new NullProtoObj() |
|---|---|---|
| Shared prototype | ❌ | ✅ |
| Hidden class reuse | ❌ | ✅ |
| Inline caching | ❌ | ✅ |
| JIT-friendly | ❌ | ✅ |
| Memory efficient | ❌ | ✅ |
Use null-prototype-object if:
$ npm install null-prototype-object --save
const NullProtoObj = require('null-prototype-object')
const obj = new NullProtoObj()
// No inherited methods
console.log(obj.toString) // undefined
// Safe for dictionary-style use
obj.__proto__ = 'polluted? nope'
console.log(obj.__proto__) // => "polluted? nope"
console.log(obj.foo)
obj.foo = 'bar'
console.log(Object.getPrototypeOf(obj)) // ==> null (via prototype chain)
NullProtoObj via constructor x 207,586,282 ops/sec ±4.80% (81 runs sampled)
Object.create(null) x 54,415,324 ops/sec ±2.01% (89 runs sampled)
{} (normal object) x 194,340,713 ops/sec ±5.15% (77 runs sampled)
{__proto__:null} x 39,313,923 ops/sec ±2.37% (92 runs sampled)
Fastest is NullProtoObj via constructor
null-prototype-object © Kiko Beats, released under the MIT License.
Credits to pi0 and anonrig. Maintained by Kiko Beats with help from contributors.
kikobeats.com · GitHub Kiko Beats · Twitter @kikobeats
FAQs
Fastest way for creating null-prototype objects in JavaScript
The npm package null-prototype-object receives a total of 68,932 weekly downloads. As such, null-prototype-object popularity was classified as popular.
We found that null-prototype-object demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.