sindresorhus/is-plain-obj
// 4 public scans exist for this repo — view full history
Nine dimensions
Top findings (AI)
No lockfile committed alongside the manifest
package.json declares devDependency ranges but no package-lock.json ships in the tree, so CI's `npm install` resolves a fresh tree each run and the package's own build reproducibility depends on npm registry timing.
Test file does not follow a discoverable naming pattern
The header reports zero test files even though test.js exists at repo root. The file lacks the conventional `.test.js` suffix or `__tests__/` directory, meaning downstream tooling, coverage reporters, and CI dashboards that key off standard patterns will silently skip it.
Only 29% of repository files were directly parsed for code review
Of the 14 files in the tree, only 4 JS/TS source files (125 lines) were analysed; the rest were unparsed. No defects were found in what was read, but benchmark.js, the type-test file, and other paths were not measured.
What this scan inspected
- every file scanned for secrets — 14 in total, none skipped
- 3 dependencies from manifests only — no lockfile, transitive deps unchecked
- deploy checks read 4 shipping file(s), 0 bind site(s) and 0 environment variable(s)
- code quality parsed 4 source file(s), 125 lines, ESLint over 4
- the AI scored from manifests and the file tree; it did not read source itself
Every section above links to the evidence behind it. Nothing on this page is asserted without a source.