All property-expr versions

[email protected] rejected Risk: 43 MIT

property-expr @1.0.1

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Tarball
43
Risk Score
MIT
License
No
Install Scripts
0
Dependencies
0
Dev Dependencies
3.2 KB
Package Size
Published

tiny util for getting and setting deep object props safely

Maintainers

theporchrat

Keywords

exprexpressionsettergetterdeeppropertyJustin-Beiberaccessor

SAST Findings (2)

CRITICAL GHSA-6fw4-hr69-g3rv: Prototype Pollution in property-expr osv

CVSS 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3), 2 info (+0).

Published to npm: