getobject

getobject is a minimal JavaScript library for reading and writing deeply-nested object properties using dot-delimited string paths, comparable to lodash’s get/set functions but shipped as a single ~65-line file with zero runtime dependencies. It exposes three functions — get, set, and exists — that resolve or create nested paths like “a.b.c” without manually guarding against undefined at every level, and it supports backslash-escaped dots for property names that themselves contain literal periods.

The library also guards against prototype pollution: set explicitly refuses to write through a proto path segment, closing the vulnerability reported as CVE-2020-28282. Despite low commit activity in recent years, the package remains widely used in practice, pulling in roughly 1.2 million weekly npm downloads, largely as a transitive dependency of Grunt-based build tooling.

What You Get

• Dot-notation path resolution that parses strings like “a.b.c” into segments, with backslash-escaping support for literal dots inside property names
• get() with optional auto-vivification — pass true to create missing intermediate objects along the path as it’s walked
• set() with prototype-pollution protection — silently refuses to write through a proto segment (the CVE-2020-28282 fix)
• exists() for safe existence checks that confirm a nested property is present without throwing on missing intermediate objects

Common Use Cases

• Reading nested configuration values from parsed JSON/YAML without repetitive a && a.b && a.b.c guard chains
• Writing to deeply nested state or options objects in build tools and CLI utilities where the target path is only known at runtime
• Safely defaulting or merging nested options objects passed into plugins/tasks — its original use case inside Grunt-based tooling
• Validating that an optional nested property exists before doing further processing

Under The Hood

Architecture The entire library is a single flat module (lib/getobject.js, ~65 lines) exporting three functions — get, set, and exists — built around one private helper, getParts, that splits a dot-notation string into path segments while honoring backslash-escaped literal dots. There’s no class hierarchy, no dependency injection, and no internal state: get() iteratively walks the object graph via parts.shift(), optionally creating intermediate objects when a create flag is passed; set() delegates to get() with that flag enabled to build out parent objects before assigning the final property; and exists() delegates to a plain get() call and checks for property presence. Because set and exists both build directly on get, any change to that one function’s traversal or escaping logic propagates to all three entry points — the whole library’s correctness rests on that single code path.

Tech Stack The library itself is dependency-free plain JavaScript shipped as CommonJS (module.exports), referenced directly via package.json’s “main” field with no build or bundling step. Its devDependencies are exclusively Grunt-based tooling — grunt, grunt-contrib-jshint, grunt-contrib-nodeunit, and grunt-contrib-watch — used for linting and running the nodeunit test suite; package.json declares a Node engines requirement of >=10.

Code Quality A single test file, test/namespace_test.js, exercises get, set, and exists using nodeunit-style assertions (test.strictEqual, test.ok, test.equal), including a dedicated test that confirms the proto prototype-pollution guard actually blocks the attack. Error handling is implicit rather than explicit — missing paths resolve to undefined rather than throwing — and there are no type annotations (plain JS, no TypeScript or JSDoc types). Static analysis is limited to jshint via a checked-in .jshintrc, and a GitHub Actions “Tests” workflow runs the suite on push. The testing stack (nodeunit + Grunt) is dated relative to current norms (Jest/Vitest) but functionally covers the core behavior and the security-relevant edge case.

API Design The public surface is deliberately minimal and consistent: three functions sharing an (obj, path, …) calling convention, each accepting either a dot-delimited string or a pre-split array for the path. There’s essentially no boilerplate to get started — require the module and call get/set/exists directly. Documentation is thin (the README covers installation only, with no full API reference), which the small surface area largely offsets. Its most notable design decision is the explicit prototype-pollution guard in set(), a security-conscious addition that most contemporary dot-path get/set utilities of its era lacked.