{"id":10606,"library":"call-bound","title":"Robust Call-Bound JavaScript Intrinsics","description":"call-bound is a utility library that provides robust, call-bound versions of JavaScript intrinsic functions, ensuring they work correctly even if `Function.prototype.call` or `Function.prototype.bind` are removed or modified from the global scope. It achieves this by internally leveraging `call-bind` and `get-intrinsic` to fetch and bind the original intrinsic methods securely. The current stable version is 1.0.4. This package is part of a suite of libraries by @ljharb focused on shims and polyfills, often released on an as-needed basis rather than a strict time-based cadence, with updates typically driven by bug fixes, security patches, or new ECMAScript features. Its key differentiator is its resilience against prototype pollution, making it vital for libraries that need to rely on core JavaScript functionality without fear of tampering in hostile environments.","status":"active","version":"1.0.4","language":"javascript","source_language":"en","source_url":"https://github.com/ljharb/call-bound","tags":["javascript","ecmascript","es","js","callbind","callbound","call","bind","typescript"],"install":[{"cmd":"npm install call-bound","lang":"bash","label":"npm"},{"cmd":"yarn add call-bound","lang":"bash","label":"yarn"},{"cmd":"pnpm add call-bound","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Core dependency for creating robust bound functions.","package":"call-bind","optional":false},{"reason":"Used to retrieve original JavaScript intrinsic values safely.","package":"get-intrinsic","optional":false}],"imports":[{"note":"The 'call-bound' package exports a default function. Named imports are incorrect.","wrong":"import { callBound } from 'call-bound';","symbol":"callBound","correct":"import callBound from 'call-bound';"},{"note":"Standard CommonJS import for Node.js environments.","symbol":"callBound","correct":"const callBound = require('call-bound');"},{"note":"For TypeScript users who need to type the result of `callBound`.","symbol":"CallBoundFunction","correct":"import type { CallBoundFunction } from 'call-bound';"}],"quickstart":{"code":"const assert = require('assert');\nconst callBound = require('call-bound');\n\n// Get a robust, bound version of Array.prototype.slice\nconst slice = callBound('Array.prototype.slice');\n\n// Simulate a hostile environment where intrinsics might be tampered with\ndelete Function.prototype.call;\ndelete Function.prototype.bind;\ndelete Array.prototype.slice;\n\n// The call-bound slice still works, unaffected by the deletions\nconst originalArray = [1, 2, 3, 4, 5];\nconst slicedArray = slice(originalArray, 1, -1); // Should be [2, 3, 4]\n\nassert.deepStrictEqual(slicedArray, [2, 3, 4]);\nconsole.log('Array.prototype.slice (call-bound) works correctly:', slicedArray);\n\n// Example with Object.prototype.hasOwnProperty\nconst hasOwnProperty = callBound('Object.prototype.hasOwnProperty');\nconst obj = { a: 1, b: 2 };\n\nassert.strictEqual(hasOwnProperty(obj, 'a'), true);\nassert.strictEqual(hasOwnProperty(obj, 'c'), false);\nconsole.log('Object.prototype.hasOwnProperty (call-bound) works correctly.');","lang":"javascript","description":"Demonstrates how to obtain a robust, call-bound intrinsic function and verifies its functionality even after simulated tampering with global prototypes, showcasing its resilience."},"warnings":[{"fix":"Ensure `call-bound` and similar fundamental utility libraries are loaded and initialized as early as possible in your application's startup process, ideally before any untrusted code or third-party libraries have a chance to run.","message":"This package relies on the integrity of `Object.prototype.hasOwnProperty` and other fundamental intrinsics during its initialization. While it protects against *subsequent* pollution, if the environment is already compromised at the point of library loading, its robustness might be limited. Always load robust utility libraries early in your application lifecycle.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Ensure your Node.js environment meets the minimum requirement of `0.4` or higher. Modern applications should use Node.js 14+.","message":"Older versions of Node.js (prior to 0.4) are not supported. While `engines` field specifies `>=0.4`, using it on extremely outdated environments might lead to unexpected behavior or missing intrinsics.","severity":"breaking","affected_versions":"<1.0.0"},{"fix":"Double-check the exact string name for the intrinsic you are trying to obtain. Refer to the ECMAScript specification or MDN for correct intrinsic paths (e.g., 'Map.prototype.get' not 'Map.get').","message":"The library fetches intrinsics by string name (e.g., 'Array.prototype.slice'). Typos or incorrect intrinsic names will lead to `undefined` or errors, as `callBound` will not be able to locate the requested intrinsic.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"Verify the intrinsic string name passed to `callBound` is correct (e.g., 'Array.prototype.slice'). Ensure the intrinsic exists in your target JavaScript environment.","cause":"`callBound` returned `undefined` because the intrinsic name was misspelled or does not exist, and the resulting `undefined` function was called.","error":"TypeError: Cannot convert undefined or null to object"},{"fix":"Use the ES module import syntax: `import callBound from 'call-bound';`","cause":"Attempting to use `require` in an ESM context (e.g., in a file with `type: module` in `package.json` or an `.mjs` file).","error":"ReferenceError: require is not defined"}],"ecosystem":"npm"}