safe-protos

safe-protos is a tiny security utility—just 640 bytes—that protects your app from the plain object trap and blocks prototype pollution attacks.

The core features? It creates objects that don’t inherit from Object.prototype, so you don’t have to worry about properties like toString or hasOwnProperty messing things up. It also handles deep merges while completely blocking risky keys like proto, constructor, and prototype. Everything runs fast, thanks to Set lookups and regular for loops. And you won’t need any extra packages; it’s a pure ESM module.

To install it, just run:

npm install safe-protos

Need a safe object with no inherited stuff? Use createSafe:

import { createSafe } from 'safe-protos';

const config = createSafe({ theme: 'dark' });
console.log(config.toString); // undefined

Want to merge user input or untrusted JSON into your app state, but keep your prototypes safe? Try safeMerge:

import { safeMerge } from 'safe-protos';

const state = { settings: { alert: true } };
const input = JSON.parse('{"settings": {"__proto__": {"polluted": true}}}');

safeMerge(state, input);
console.log({}.polluted); // undefined

The API is pretty simple:

• createSafe(data?): Builds an object with a null prototype.
• safeMerge(target, source): Deep merges and blocks dangerous keys.
• isSafe(key): Checks if a key won’t pollute the prototype.

MIT license, © oopsio.