Pathval securely accesses nested JavaScript object properties using a path string. It prevents prototype pollution vulnerabilities commonly associated with bracket notation and dot notation. This package is lightweight, performant, and provides robust validation, making it ideal when dealing with user-supplied paths or untrusted data. It includes options to customize allowed characters in the path and disable certain checks for enhanced control.
Pathval's npm package downloads show significant growth, starting from 26 million in March 2024, peaking at 98 million in July 2025. August 2025 saw a drop to 89 million. September 2025 downloads are incomplete, currently showing 34 million. Overall, the package demonstrates a strong upward trend in usage.
Pathval's release frequency is sporadic. Initial releases occurred in late 2013. After a long pause, there were bursts in October 2016 and a single release in January 2021 and July 2023. The most recent release was in June 2025. Overall, releases are infrequent and clustered.
