es6-shim: an archived compatibility layer with a misspelled publish hook and a dependency directory at the root

The deprecation notice, the archive flag, and two version numbers with no release

The first thing this repository says is a warning: the repository has been deprecated, and the last stable version was v0.35.8. GitHub carries the archive flag as well, so the project states its own ending twice.

The package file agrees in a quieter way. Its version field reads 0.35.8, while the newest version installable from a tag is 0.35.6. The releases listed around it, 0.35.5 and 0.35.4, all landed inside a two minute window on 2022-08-12, from 04:05:12 to 04:06:53. The last two version numbers in the package were therefore never cut as releases.

The commit history is a separate clock, and it is not silent: the most recent push is dated 2026-10-02. A recent commit and a deprecated project can sit in the same repository, so read the warning rather than the push date when deciding what to install.

One npm command, and three files to load in a fixed order in the browser

Installation takes one command:

npm install es6-shim

The browser path is longer, and it is really an ordering contract. Include es6-shim before your own scripts. Then include es5-shim, with a note that it matters especially if the browser has no ECMAScript 5 support, but that every JavaScript engine needs it to correct broken implementations, so it is strongly recommended in all cases. That note also fixes the order: es5-shim should be loaded before es6-shim.

A third file is offered as a want rather than a requirement, in browsers and in node alike: unorm, for String.prototype.normalize, with a pointer to a later section for the details.

So the documented browser setup is three scripts in a fixed sequence, and the one the text pushes hardest on is the middle file, not the package you came for.

Every shim carries its own precondition, and they are not the same precondition

Each entry in the list states its requirement in parentheses, and the requirements differ. Map and Set require ES5 property descriptor support. The RegExp flags getter requires ES5. The four RegExp.prototype symbol methods, [Symbol.match], [Symbol.replace], [Symbol.search], and [Symbol.split], each require native Symbols, so the engine has to have Symbol before any of them can apply. The Symbol shims themselves install only if Symbol already exists, and the well-known symbols appear only when the engine has Symbol support. Object.setPrototypeOf is marked IE 11 and above. Object.keys is described as present in ES5 but noted as no longer throwing on non-object, non-null values in ES6.

Most entries also link a standalone package for that single method, so a project can take Math.sign alone. Promise carries no such link, and neither do Array.prototype.fill, Object.setPrototypeOf, or the Math additions asinh, cosh, expm1, log2, sinh, tanh, and trunc. The Annex B HTML method list runs anchor() through fontcolor(), fontsize(), italics(), and link(), and then stops at an entry beginning sma.

One accuracy figure covers seventeen Math methods

A single sentence carries the accuracy claim for the whole Math group: Math functions' accuracy is 1e-11. It follows a list of seventeen methods, from acosh through trunc, without singling out any one of them.

Nothing further in the document defines the figure. It does not say whether 1e-11 is relative or absolute, which implementation it was measured against, or over what range of inputs. A caller weighing cbrt or log2 against a tolerance of its own has to take the blanket number as it stands.

One entry changes behaviour instead of adding a missing method, and it carries the same lack of detail. Given a RegExp as the pattern, new RegExp will no longer throw when it is also handed a flags string, an errata fix rather than a new function.

Two sources, two builds, two suites, and rejections silenced during the run

The build and test layout treats the package as two sources. There is es6-shim.js with es6-shim.min.js and es6-shim.map, and es6-sham.js with es6-sham.min.js and es6-sham.map, alongside test/ and test-sham/, lint targets named lint:shim and lint:sham, and minify targets named minify:shim and minify:sham. One entry in the shim list is labelled with the sham name directly: Function.prototype name, marked es6-sham, covers IE 9-11.

Three scripts decide what a test run means:

"test": "NODE_OPTIONS='--unhandled-rejections=none' npm run tests-only",
"tests-only": "nyc mocha 'test/**/*.js' 'test-sham/*.js'",
"test:native": "NO_ES6_SHIM=1 npm run tests-only",

The main entry sets unhandled rejections to none before the suites run, so a rejection escaping an assertion cannot fail the run by itself. The native variant reruns the same two directories with NO_ES6_SHIM=1. The minify targets run uglifyjs with support-ie8 and ascii_only output, which is the clearest statement of the audience this build was aimed at.

A publish hook that npm can never call, and an audit on every test run

The scripts block spells the publish step twice:

"prepublishOnly": "safe-publish-latest && npm run minify",
"prepublih": "not-in-publish || npm run prepublishOnly",

The publish hooks npm recognises are named prepublishOnly, prepublish, prepack and prepare, so the second line is a misspelling that nothing invokes, and the not-in-publish guard it wraps never executes. What that guard was meant to stop is not stated anywhere.

Two more hooks bracket the test entry. pretest runs the lint targets and evalmd over the markdown files, so linting and doc checks are prerequisites of the suite rather than separate commands. posttest runs a production dependency audit through npx against a pinned npm version, so finishing the tests also reaches the network. A separate sauce-connect target pipes a script from a gist into bash and exports a variable named TRAVIS_SAUCE_CONNECT, and the root still carries a .travis.yml.

Three manifests for one project, and the dependency tree in the root

The repository root holds a node_modules directory, so the installed dependency tree sits beside the sources rather than being produced by an install. It sits next to three manifests for one project: package.json for npm, bower.json for Bower, and component.json for the older component format. The entry point is written as "main": "es6-shim", with no file extension, and the repository field still uses the git protocol. testling.html and a Gruntfile.js are present as well, beside the source maps, the minified builds, and a CHANGELOG.md.

Four dotfiles govern the parts that matter at install time, and none of them is explained in the documentation: .npmignore decides what leaves the package, .npmrc what the client does, .nycrc what coverage means, and .eslintrc what the lint targets accept.

That is the general shape of this project. The shim list is itemised down to per method preconditions, while the packaging around it is left to whatever the files happen to contain.

Editorial conclusion

Read it as a finished artifact rather than a dependency to add: the repository is archived, deprecated, and names v0.35.8 as its last stable version, while the newest tag anyone can install is v0.35.6 from 2022-08-12. The parts worth keeping are the load order it asks for, es5-shim before es6-shim, the optional unorm file for normalize, and the single accuracy figure it publishes for its Math methods. If you find it installed somewhere, check the version actually on disk against the 0.35.8 in its package file before assuming it matches the newest tag.

Frequently asked questions

Official sources

1. License: MIT
2. paulmillr/es6-shim on GitHub
3. Project website
4. README
5. Releases