diff --git a/package.json b/package.json
index c76e8db..79f1b11 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,6 @@
   "author": "Valeri Karpov <val@boosterfuels.com>",
   "dependencies": {
     "lodash.clonedeep": "4.x",
-    "lodash.set": "4.x",
     "mpath": "0.8.x"
   },
   "devDependencies": {
diff --git a/src/index.js b/src/index.js
index 2cd4bea..49fcdb4 100644
--- a/src/index.js
+++ b/src/index.js
@@ -4,7 +4,7 @@ const Path = require('./path');
 const Type = require('./type');
 const cloneDeep = require('lodash.clonedeep');
 const get = require('./get');
-const set = require('lodash.set');
+const set = require('./set');
 const specialProperties = require('./specialProperties');
 const unmarshal = require('./unmarshal');
 
diff --git a/src/set.js b/src/set.js
new file mode 100644
index 0000000..3055efb
--- /dev/null
+++ b/src/set.js
@@ -0,0 +1,17 @@
+'use strict';
+
+/*!
+ * Simplified lodash.set to remove https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032?_gl=1%2a2zj3r0%2a_ga%2aMTkwMjAxNzQxNC4xNjkwMjA0OTEz%2a_ga_X9SH3KP7B4%2aMTY5MDIwNDkxMi4xLjEuMTY5MDIwNDkxNy4wLjAuMA..
+ * Source: https://youmightnotneed.com/lodash#set
+ */
+
+module.exports = function set(obj, path, value) {
+  // Regex explained: https://regexr.com/58j0k
+  const pathArray = Array.isArray(path) ? path : path.match(/([^[.\]])+/g)
+
+  pathArray.reduce((acc, key, i) => {
+    if (acc[key] === undefined) acc[key] = {}
+    if (i === pathArray.length - 1) acc[key] = value
+    return acc[key]
+  }, obj)
+}