Recommended action

Update @ranfdev/deepobj to 1.0.3 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

@ranfdev/deepobj has a Prototype Pollution vulnerability affects @ranfdev/deepobj (npm). Severity is high. ### Impact Prototype pollution is possible when property paths contain `__proto__`/`constructor`/`prototype`. The property path must not be exposed as user input.

AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Evidence and references

Recommended action

Update @ranfdev/deepobj to 1.0.3 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

@ranfdev/deepobj has a Prototype Pollution vulnerability affects @ranfdev/deepobj (npm). Severity is high. ### Impact Prototype pollution is possible when property paths contain `__proto__`/`constructor`/`prototype`. The property path must not be exposed as user input.

AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Evidence and references