unset-value - npm Package Compare versions

Comparing version 2.0.0 to 2.0.1

index.js

@@ -13,2 +13,12 @@ /*!
 
+const isUnsafeKey = key => {
+  return key === '__proto__' || key === 'constructor' || key === 'prototype';
+};
+
+const validateKey = key => {
+  if (isUnsafeKey(key)) {
+    throw new Error(`Cannot set unsafe key: "${key}"`);
+  }
+};
+
 module.exports = function unset(obj, prop) {
@@ -32,3 +42,7 @@ if (!isObject(obj)) {
     }
-    while (segs.length) obj = obj[prop = segs.shift()];
+    while (segs.length) {
+      prop = segs.shift();
+      validateKey(prop);
+      obj = obj[prop];
+    }
     return (delete obj[last]);
@@ -35,0 +49,0 @@ }

package.json

 {
   "name": "unset-value",
   "description": "Delete nested properties from an object using dot notation.",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "homepage": "https://github.com/jonschlinkert/unset-value",
@@ -6,0 +6,0 @@ "author": "Jon Schlinkert (https://github.com/jonschlinkert)",

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

9881

increased by2.93%

Lines of code

43

increased by38.71%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes