npmUtilsupdated 08 Aug 2026

is2

Item: is2
Rating: 2.8
Author: Keyoor

is2 is a CommonJS collection of boolean checks for JavaScript values. It covers primitives, arrays and objects, number relationships, deep equality, IP and host strings, ports, UUIDs, Mongo-style IDs, card-number formats, and a few US contact formats. Every check returns true or false instead of throwing. The breadth looks convenient, but the implementation mixes simple type tests with old, permissive validation rules, so it belongs in low-risk guards and tests rather than a security boundary.

is2 · v2.0.9 · 4.5M/wk · ★ 10 · pushed 30 Dec 2022 · stdarg/is2 · docs · reviewed by Keyoor

Verdict

is2 is broad and easy to call, but several implementation quirks make it a poor new dependency for serious validation. Keep it in legacy tests or low-risk guards; choose a focused validator or schema library for new input boundaries.

API stability4/5The library is a flat object of boolean functions and aliases, and the README documents a large surface that has changed little across the 2.x line. That makes existing calls unlikely to break. Stability does not mean intuitive semantics, though: source-level oddities such as the instanceOf alias reassignment, unanchored UUID regex, and boxed-value checks are effectively part of the behavior callers inherit.

Docs2/5The README inventories most functions and aliases and gives a minimal install example, while the package ships a long declaration file. It rarely specifies edge cases, accepted formats, coercion, or failure examples. Important facts such as number(NaN) returning true, the process-global browser hazard, and the limited validation logic are visible only by reading index.js and tests.

Maintenance2/5The repository is not archived, but npm version 2.0.9 dates to September 2022 and GitHub reports the last push in December 2022. The repository has 4 open issues and pull requests in GitHub's combined counter. A stable predicate library may not need frequent releases, but stale network, payment-card, and personal-information rules are more concerning than stale primitive checks.

Ecosystem3/5is2 recorded 4,543,876 downloads for the measured week, yet the repository has 10 stars and the README lists no plugin system or framework integrations. Much of that use is likely transitive or legacy. It interoperates easily because every API returns a boolean, but it does not provide schema composition, localized errors, transforms, or TypeScript inference.

Use it if

You maintain CommonJS code that already uses is2 aliases and replacing them would add churn without changing behavior
Tests need compact boolean helpers for numbers, empty values, deep equality, or array membership
A small Node utility needs several unrelated checks and false is a sufficient failure result
You need the package's legacy behavior exactly, including boxed primitive recognition through Object.prototype.toString

Skip it if

Validation protects accounts, payments, or network access: the source uses permissive regexes and hand-written rules, and even describes street-address detection as a work in progress
You need browser code without a process shim: nodejs() reads the global process identifier without a typeof guard, and browser() calls nodejs() first, so a plain browser can throw instead of returning false
You want TypeScript narrowing: the bundled declarations return boolean rather than type predicates, so checks such as string(value) do not narrow unknown to string
You expect names to match modern JavaScript semantics: number(NaN) is true, notANumber('text') is also true, and object() deliberately excludes arrays, dates, regexes, and errors
Current validation tables matter: version 2.0.9 was published in September 2022, the last repository push was in December 2022, and several card-brand rules in the source encode narrow legacy ranges

Setup reality

npm install is2 is the whole install step. There are no native modules, peer dependencies, credentials, or configuration files, and version 2.0.9 includes an index.d.ts. Runtime use is CommonJS with const is = require('is2'); the declaration file exposes named functions, so TypeScript projects with stricter CommonJS interoperability may need import is = require('is2') or a compiler interop setting rather than a default import. Three runtime dependencies are installed: deep-is, ip-regex, and is-url. The important work is deciding which checks you trust. number() uses the internal object tag, which accepts NaN and boxed Number objects. IPv4 parsing uses parseInt on each dot-separated part and does not confirm that every character was numeric. UUID matching is not anchored, so a longer string containing a UUID can pass. browser() is unsafe when process is truly absent. The source also reassigns instanceOf aliases when defining objectInstanceOf, narrowing behavior in a surprising way. Treat email, address, phone, card, URL, and network helpers as convenience screening only, then use a purpose-built parser or authoritative service where false positives have consequences. All functions collapse failure details to false, so callers must build their own useful error messages.

Patterns

Load is2 in CommonJSimport-commonjs

const is = require('is2');

console.log(is.version);

The runtime entry is CommonJS. Do not assume a default ESM import works without your compiler or bundler's interoperability layer.

Check common value typescheck-primitives

is.string('hello');   // true
is.number(42);       // true
is.boolean(false);   // true
is.array([1, 2]);    // true
is.date(new Date()); // true

These checks use Object.prototype.toString, so boxed primitives pass. number(NaN) is also true; use notANumber when NaN must be rejected.

Distinguish missing and nullish valuescheck-nullish

is.defined(value);
is.undefined(value);
is.null(value);
is.nullOrUndefined(value);

defined(null) is true. Use nullOrUndefined when both null and undefined mean missing in your application.

Distinguish sync and async functionscheck-functions

is.function(() => 1);             // true
is.syncFunction(() => 1);         // true
is.asyncFunction(async () => 1);  // true

Generator functions are not included by function(), which only combines the source's sync and async function tag checks.

Test supported containers for emptinesscheck-empty-values

is.empty([]);     // true
is.empty({});     // true
is.empty('');     // true
is.empty(null);   // false
is.empty(0);      // false

Whitespace strings are not empty, and Map or Set instances are not handled by empty().

Check integer and sign constraintscheck-number-shape

is.integer(12);          // true
is.decimal(12.5);        // true
is.positiveInteger(12);  // true
is.negativeNumber(-0.5); // true
is.even(12);             // true

Zero is neither positive nor negative, and divisibleBy(0, n) deliberately returns false.

Check ranges and approximate decimalscheck-number-range

is.within(7, 1, 10);          // true
is.greaterOrEqualTo(7, 7);   // true
is.prettyClose(1.234, 1.233, 2); // true

within includes both boundaries. prettyClose compares toFixed strings, so it tests rounded decimal places rather than an absolute tolerance.

Compare arrays and objects deeplycompare-deep-values

is.equal(
  { user: { id: 7 }, roles: ['admin'] },
  { user: { id: 7 }, roles: ['admin'] }
); // true

Objects and arrays are delegated to deep-is. This is a boolean comparison, not an assertion with a useful diff.

Check a value against allowed choicesmatch-enumerated-value

is.matching('draft', 'draft', 'published'); // true
is.enumerator('admin', ['user', 'admin']);  // true

matching uses strict equality against later arguments. enumerator expects an array-like second value.

Screen host and IP stringscheck-network-address

is.ipv4Address('192.0.2.10');
is.ipv6Address('2001:db8::1');
is.dnsAddress('api.example.com');
is.hostAddress('api.example.com');

Use these as screening checks only. The IPv4 implementation parses octets with parseInt and does not verify that each octet contains digits only.

Check TCP port rangescheck-port

is.port(443);        // true
is.systemPort(443);  // true: 0 through 1023
is.userPort(8080);   // true: 1024 through 65535

port accepts 0 and requires a Number value. Numeric strings such as '443' return false.

Screen UUID and Mongo-style IDscheck-identifiers

is.uuid('550e8400-e29b-41d4-a716-446655440000');
is.mongoId('507f1f77bcf86cd799439011');

The UUID regex is not anchored, so a longer string containing a valid-looking UUID may pass. Add your own full-string check when that matters.

Alternatives

Package	Registry	Pick it when
is-type-of	npm	You want a focused CommonJS set of runtime type predicates with fewer domain validators
is-what	npm	You want modern TypeScript-friendly value checks and package formats
validator	npm	String validation such as email, URL, IP, and payment-card formats is the main job
zod	npm	You need composable schemas, parsed output, TypeScript inference, and useful validation errors