Production-readiness scan · 2026-08-27
sindresorhus/is-plain-obj
Workable, with significant gaps to close.
PARTIAL Dependencies were read from manifests only; transitive packages were not checked.
Fix first
No lockfile committed
Dependency versions are declared as ranges, so two installs can resolve to different code and transitive dependencies could not be checked at all. Commit the lockfile your package manager produces.
No committed lockfile
package.json lists only dev ranges and no package-lock.json / npm-shrinkwrap.json is shipped. CI runs npm install (not npm ci), so reproducible builds and supply-chain audits depend on whoever runs install first. This also blocks the 'lockfile + reproducible build' devops floor from applying.
CI matrix limited to Ubuntu
.github/workflows/main.yml only tests on ubuntu-latest. Cross-Platform regressions in index.js (e.g., realm/Object.create behavior on different Node builds) could ship undetected. Adding windows-latest and macos-latest is cheap and standard for npm packages.
Nine dimensions
Top findings (AI)
No committed lockfile
package.json lists only dev ranges and no package-lock.json / npm-shrinkwrap.json is shipped. CI runs npm install (not npm ci), so reproducible builds and supply-chain audits depend on whoever runs install first. This also blocks the 'lockfile + reproducible build' devops floor from applying.
CI matrix limited to Ubuntu
.github/workflows/main.yml only tests on ubuntu-latest. Cross-Platform regressions in index.js (e.g., realm/Object.create behavior on different Node builds) could ship undetected. Adding windows-latest and macos-latest is cheap and standard for npm packages.
No automated dependency-update workflow
Despite 100+ stars and broad downstream use, there is no Dependabot, Renovate, or scheduled osv-scanner job. Given ava/tsd/xo all have active upstream releases, manual upgrades will lag and silent transitive drift is plausible.
Test breadth not externally verifiable
test.js and index.test-d.ts exist and are invoked by ava and tsd, but coverage scope (edge cases like null prototype, arrays, class instances, cross-realm) is not visible from metadata; CI logs would be needed to confirm.
Report sections
Open a section for the evidence that drove the score. If you open one first, start with Code.
What this scan inspected
- every file scanned for secrets — 15 in total, none skipped
- 3 dependencies from manifests only — no lockfile, transitive deps unchecked
- the AI scored from manifests and the file tree; it did not read source itself
- scores adjusted by deterministic evidence: 1 lowered by deterministic ceilings
Every section above links to the evidence behind it. Nothing on this page is asserted without a source.