has
Object.prototype.hasOwnProperty.call shortcut
6
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
tarruda
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): ljharb is explicitly listed as a contributor in package.json; this is a documented, legitimate maintainer transition from tarruda. ljharb has a strong track record (2847 approved packages). | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): `has` is a distinct, well-established utility package with no relation to `hapi`; Levenshtein distance of 2 on a 3-char name is not meaningful typosquatting. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): `has` is a distinct, well-established utility package with no relation to `qs`; Levenshtein distance of 2 on short names is not meaningful typosquatting. | ai | |
| bogus-package | bogus-package | AI (bogus-package): `has` is a legitimate micro-utility; tiny payload and inflated semver are expected characteristics of this historically published package. | ai |