← Home

kind-of

Get the native type of a value.

23
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

doowbjonschlinkert

Keywords

argumentsarraybooleancheckdatefunctionisis-typeis-type-ofkindkind-ofnumberobjectofregexpstringtesttypetype-oftypeoftypes

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:new-function-constructor AI (semgrep): Usage is in test.js only, as a test input to verify type detection. Not in production code; no dynamic code execution risk. ai
provenance publisher-changed AI (provenance): doowb is a known, trusted collaborator in the jonschlinkert ecosystem; this is a documented legitimate maintainer transition, not a compromise. ai
maintainer-change maintainer-added AI (maintainer-change): doowb is a long-standing collaborator with strong track record (54 approved packages); addition is a legitimate handoff. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy followed by 6.0.3 is explained by a targeted security fix for prototype pollution; consistent with legitimate maintenance. ai
source-diff source-size-tripled AI (source-diff): Size increase reflects added constructor-based type checking for the prototype pollution security fix, not injected payload. ai

Versions (showing 23 of 23)

Version Deps Published
6.0.3 0 / 5
5.1.0 0 / 8
5.0.2 0 / 8
5.0.1 0 / 8
5.0.0 0 / 7
4.0.0 1 / 8
3.2.2 1 / 8
3.2.1 1 / 8
3.2.0 1 / 7
3.1.0 1 / 8
3.0.4 1 / 8
3.0.3 1 / 9
3.0.2 1 / 8
3.0.1 1 / 9
3.0.0 1 / 9
2.0.1 1 / 7
2.0.0 0 / 7
1.1.0 0 / 6
1.0.1 0 / 6
1.0.0 0 / 6
0.1.2 0 / 8
0.1.1 0 / 3
0.1.0 0 / 3