destr

Safe, fast alternative to JSON.parse — handles prototype pollution, JSON syntax errors, and common edge cases gracefully.

destr

General JS

Safe, fast alternative to JSON.parse — handles prototype pollution, JSON syntax errors, and common edge cases gracefully.

Fit

Bundle (gzip)

721 B

1.4 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

JSON.parse throws on invalid input, making you wrap every call in try/catch. It's also vulnerable to prototype pollution via __proto__ keys in malicious input, and doesn't handle non-string inputs gracefully.

What It Does

destr parses JSON safely — it returns the input as-is if it's not a string, returns undefined on parse errors instead of throwing, and strips __proto__, constructor, and prototype keys to prevent prototype pollution. It's a drop-in JSON.parse replacement for user-supplied or untrusted data.

Installation

bash
npm install destr

Usage Example

typescript
import { destr, safeDestr } from 'destr';

// Safe parsing — no try/catch needed
destr('{"name": "Alice"}');   // { name: 'Alice' }
destr('invalid json');        // 'invalid json' (returns as-is)
destr(undefined);             // undefined
destr(42);                    // 42

// Prototype pollution prevention
destr('{"__proto__": {"admin": true}}'); // {} (strips __proto__)

// Strict mode — throws on invalid JSON
safeDestr('not json'); // throws SyntaxError

Related packages