call-bound

library1.0.4jsnpmunverified

call-bound is a utility library that provides robust, call-bound versions of JavaScript intrinsic functions, ensuring they work correctly even if `Function.prototype.call` or `Function.prototype.bind` are removed or modified from the global scope. It achieves this by internally leveraging `call-bind` and `get-intrinsic` to fetch and bind the original intrinsic methods securely. The current stable version is 1.0.4. This package is part of a suite of libraries by @ljharb focused on shims and polyfills, often released on an as-needed basis rather than a strict time-based cadence, with updates typically driven by bug fixes, security patches, or new ECMAScript features. Its key differentiator is its resilience against prototype pollution, making it vital for libraries that need to rely on core JavaScript functionality without fear of tampering in hostile environments.

serialization

npm install call-bound

github ↗package ↗

INSTALL

IMPORT

SIG · CALL-BOUND

call-bound

serializationjavascriptv1.0.4

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

callBound

✓ import callBound from 'call-bound';

✗ import { callBound } from 'call-bound';

The 'call-bound' package exports a default function. Named imports are incorrect.

callBound

✓ const callBound = require('call-bound');

Standard CommonJS import for Node.js environments.

CallBoundFunction

✓ import type { CallBoundFunction } from 'call-bound';

For TypeScript users who need to type the result of `callBound`.

Demonstrates how to obtain a robust, call-bound intrinsic function and verifies its functionality even after simulated tampering with global prototypes, showcasing its resilience.

const assert = require('assert'); const callBound = require('call-bound'); // Get a robust, bound version of Array.prototype.slice const slice = callBound('Array.prototype.slice'); // Simulate a hostile environment where intrinsics might be tampered with delete Function.prototype.call; delete Function.prototype.bind; delete Array.prototype.slice; // The call-bound slice still works, unaffected by the deletions const originalArray = [1, 2, 3, 4, 5]; const slicedArray = slice(originalArray, 1, -1); // Should be [2, 3, 4] assert.deepStrictEqual(slicedArray, [2, 3, 4]); console.log('Array.prototype.slice (call-bound) works correctly:', slicedArray); // Example with Object.prototype.hasOwnProperty const hasOwnProperty = callBound('Object.prototype.hasOwnProperty'); const obj = { a: 1, b: 2 }; assert.strictEqual(hasOwnProperty(obj, 'a'), true); assert.strictEqual(hasOwnProperty(obj, 'c'), false); console.log('Object.prototype.hasOwnProperty (call-bound) works correctly.');

Debug

Known issues

gotchaThis package relies on the integrity of `Object.prototype.hasOwnProperty` and other fundamental intrinsics during its initialization. While it protects against *subsequent* pollution, if the environment is already compromised at the point of library loading, its robustness might be limited. Always load robust utility libraries early in your application lifecycle.

fix

Ensure `call-bound` and similar fundamental utility libraries are loaded and initialized as early as possible in your application's startup process, ideally before any untrusted code or third-party libraries have a chance to run.

affects: >=1.0.0

breakingOlder versions of Node.js (prior to 0.4) are not supported. While `engines` field specifies `>=0.4`, using it on extremely outdated environments might lead to unexpected behavior or missing intrinsics.

fix

Ensure your Node.js environment meets the minimum requirement of `0.4` or higher. Modern applications should use Node.js 14+.

affects: <1.0.0

gotchaThe library fetches intrinsics by string name (e.g., 'Array.prototype.slice'). Typos or incorrect intrinsic names will lead to `undefined` or errors, as `callBound` will not be able to locate the requested intrinsic.

fix

Double-check the exact string name for the intrinsic you are trying to obtain. Refer to the ECMAScript specification or MDN for correct intrinsic paths (e.g., 'Map.prototype.get' not 'Map.get').

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: Cannot convert undefined or null to object

`callBound` returned `undefined` because the intrinsic name was misspelled or does not exist, and the resulting `undefined` function was called.

fix

Verify the intrinsic string name passed to `callBound` is correct (e.g., 'Array.prototype.slice'). Ensure the intrinsic exists in your target JavaScript environment.

ReferenceError: require is not defined

Attempting to use `require` in an ESM context (e.g., in a file with `type: module` in `package.json` or an `.mjs` file).

fix

Use the ES module import syntax: `import callBound from 'call-bound';`

Upgrade

Version history

1.0.4latest on npm

Audit

Dependencies

call-bindrequiredCore dependency for creating robust bound functions.

get-intrinsicrequiredUsed to retrieve original JavaScript intrinsic values safely.

Agent activity

16 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/ljharb/call-bound ↗

packagehttps://www.npmjs.com/package/call-bound ↗