sindresorhus/is-plain-obj

57/100
// permanent record of scan from 2026-08-27 · classified as library · stack: JavaScript · Node.js >=18 · ESM · ava · tsd · xo
// permalink — this URL always shows scan EfZGyhkO from 2026-08-27, even if a newer public scan exists for this repo.
// a newer public scan exists: www.codeclanker.com/scan/sindresorhus/is-plain-obj

Nine dimensions

DevOps
55
GitHub Actions CI runs xo/ava/tsd on Node 18 and 22, but uses npm install without a lockfile and only tests Ubuntu.
Security
58
Zero runtime dependencies, no secrets, MIT license, and a SECURITY.md present; only weakness is no committed lockfile pinning.
Cost & infra
60
MIT license, zero runtime deps, no infra cost; Tidelift promotion suggests a sustainability channel is in place.
QA & testing
50
ava + tsd + benchmark are wired into npm test and CI, but coverage depth and case variety in test.js are not visible.
Performance
60
benchmark.js is present and CI exercises it via npm test, giving an empirical performance baseline; no perf budget documented.
Architecture
55
Single-function export, clean ESM-only entry, index.d.ts shipped; trivial scope leaves little to evaluate beyond exports shape.
Code quality
60
Single-purpose ESM library with TypeScript types, xo lint, and a tight scope; source not inspected in detail.
Observability
50
Library context: README documents expected return values clearly; no telemetry, which is appropriate for a tiny pure function.
Maintainability
62
Custom README with realistic examples, MIT license, funding and author links; no CHANGELOG or CONTRIBUTING guide visible.

Top findings (AI)

medium

No committed lockfile

package.json lists only dev ranges and no package-lock.json / npm-shrinkwrap.json is shipped. CI runs `npm install` (not `npm ci`), so reproducible builds and supply-chain audits depend on whoever runs install first. This also blocks the 'lockfile + reproducible build' devops floor from applying.

medium

CI matrix limited to Ubuntu

.github/workflows/main.yml only tests on ubuntu-latest. Cross-Platform regressions in index.js (e.g., realm/Object.create behavior on different Node builds) could ship undetected. Adding windows-latest and macos-latest is cheap and standard for npm packages.

medium

No automated dependency-update workflow

Despite 100+ stars and broad downstream use, there is no Dependabot, Renovate, or scheduled osv-scanner job. Given ava/tsd/xo all have active upstream releases, manual upgrades will lag and silent transitive drift is plausible.

medium

Test breadth not externally verifiable

test.js and index.test-d.ts exist and are invoked by `ava` and `tsd`, but coverage scope (edge cases like null prototype, arrays, class instances, cross-realm) is not visible from metadata; CI logs would be needed to confirm.

What this scan inspected

Every section above links to the evidence behind it. Nothing on this page is asserted without a source.

Scan your own repo

Free 60-second scan. No signup.

Run a free scan →