
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Minimal, runtime-safe type guards for modern JavaScript.
Tree-shakable ESM bundle, zero-config, developer-friendly guards for typeof, instanceof, and structural checks.
typeof and instanceof matchingMap, URL, etc.)instanceof checks (runtime hardened)true | false)globalThis.__DEV__ or NODE_ENV !== "production"assertType.* versionsis.str, is.num, is.bool, is.bigi, is.sym, is.undefJavaScript type checks are deceptively inconsistent:
typeof null === "object"Array.isArray(x) is required for arraysinstanceof can throw in exotic or cross-realm scenariosHTMLElement don’t exist in NodeNanoTypes centralizes and hardens these checks into a small, predictable surface.
TypeScript is compile-time. NanoTypes is runtime.
They solve different problems.
At runtime, TypeScript types disappear. Values coming from:
JSON.parselocalStoragemay not match their declared types.
NanoTypes validates those values at runtime.
NanoTypes guards are typed as proper type predicates:
if (is.string(x)) {
// x is now narrowed to string
}
assertType.numberSafe(x);
// x is guaranteed to be a non-NaN number here
This means:
as casts@ts-ignore commentsTypeScript tells you what should be true. NanoTypes checks what is true.
NanoTypes is hardened for modern environments:
globalThis constructorsHTMLElement in Node)instanceof handlingfalseTypeError messages with readable descriptionsTypeError)globalThisnpm install nanotypes
import { is, assertType, describe } from 'nanotypes';
if (is.string("hello")) {
console.log("It's a string!");
}
// Shorthand aliases
if (is.str("hello")) {
console.log("Short and sweet.");
}
if (is(someValue, HTMLElement)) {
someValue.focus();
}
assertType.promise(Promise.resolve()); // throws TypeError if invalid
console.log(describe.value(new Map())); // "Map"
is(value, Class)
instanceof internallyglobalThis.__DEV__ = true or when process.env.NODE_ENV !== "production")false on invalid constructor inputGuards are generated dynamically from available runtime constructors. Some guards may only exist when the constructor exists in that environment (e.g., DOM-related guards in browsers but not in Node).
| Guard | Description |
|---|---|
is.string(x) / is.str(x) | typeof x === "string" |
is.number(x) / is.num(x) | typeof x === "number" (includes NaN) |
is.numberSafe(x) | Number and not NaN |
is.boolean(x) / is.bool(x) | Boolean primitive |
is.bigint(x) / is.bigi(x) | BigInt primitive |
is.symbol(x) / is.sym(x) | Symbol primitive |
is.undefined(x) / is.undef(x) | Strictly undefined |
is.defined(x) | Not null or undefined |
is.nullish(x) | null or undefined |
is.nil(x) | Strictly null |
is.array(x) | Array literal check |
is.object(x) | Non-null object, not array |
is.objectStrict(x) | Exactly a {} object |
is.plainObject(x) | Object with prototype Object or null |
is.func(x) | Function check |
is.map(x) | Instance of Map |
is.date(x) | Instance of Date |
is.error(x) | Instance of Error |
is.textNode(x) | DOM Text node (browser only) |
is.htmlElement(x) | HTMLElement node (browser only) |
is.contentEditable(x) | Editable DOM node |
is.positiveNumber(x) | Greater than 0 |
is.negativeNumber(x) | Less than 0 |
is.integer(x) | Whole number |
is.finite(x) | Not Infinity, not NaN |
is.truthy(x) | Narrowed to non-falsy value |
is.falsy(x) | Falsy value |
⚠️ Note
is.number(x)follows standard JavaScript semantics and returnstrueforNaN. Useis.numberSafe(x)if you require a numeric value that is notNaN.
All is.* functions have an assertType.* equivalent:
assertType.url(x) // throws TypeError if not a URL
Use guards for conditional logic. Use asserts when invalid input should immediately fail.
NanoTypes dynamically inspects globalThis to expose constructor-based guards.
This means:
HTMLElement) will not exist in Node.If writing universal libraries, you can safely check:
if (typeof is.htmlElement === 'function' && is.htmlElement(node)) {
// browser-only logic
}
NanoTypes may not be necessary if:
NanoTypes is designed as a lightweight guard layer — not a schema system.
Make JavaScript safer without making it heavier.
NanoTypes avoids boilerplate and unnecessary runtime bloat. Just clean, modern type guards ready for anything from browser UIs to CLI tools.
env.jsinstanceof guardsis, assertType, and describeIntl constructor detectionBigInt constructor to prevent primitive naming confusionstr, num, bool, bigi, sym, undef)DR.WATT v3.0
FAQs
Minimal, runtime-safe type checks for modern JS & TS
We found that nanotypes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.