sindresorhus/kylibrary

Audited from a 0k-token evidence dossier; 4 files read, 13 probes answered.

Ky is a fetch wrapper with zero runtime dependencies that adds retries, timeouts, hooks, and Standard Schema validation on top of the native fetch API ^[26][11]. The design surface is unusually well documented at the type level, with extensive JSDoc examples for every hook and method ^[29].

The central tension is between the library's polished exterior and thinner spots underneath: half of merged pull requests carry no review ^[27], and this dossier's own CVE scan could not complete, leaving the dependency posture partly unverified ^[28].

What holds up:

• The zero-dependency claim checks out. Manifest data confirms deps_direct=0, directly backing the README's "tiny package with no dependencies" line rather than leaving it as an unverified claim ^[11].
• Maintenance turnaround is fast and consistent. Median issue first-response and close times sit under a day, and the project has shipped 96 releases with 100% release-note coverage, 25 of them in the last 24 months ^[27].
• The API surface is thoroughly designed and documented. Hooks, retry control symbols, context propagation, and generics are all specified with worked examples in the type definitions, which is more documentation depth than most libraries of this size carry ^[29].
• Test coverage is real despite an automated false negative. The assertion-grep probe reported no assertions in test files, but the sampled test files contain substantive AVA assertions covering memory leaks and hook context propagation ^[30][15].

The main knocks:

• Half of merged pull requests carry no review at all. Only 50% of sampled merged PRs had at least one review, and top-10 contributors account for 78% of activity, so most changes land on a single maintainer's judgment rather than a checked process ^[27].
• The internals are not as tiny as the README framing suggests. source/utils/merge.ts carries a complexity score of 103 in just 324 lines, far above the codebase's p90 of 20, and 17 files show 6+ levels of nesting, indicating a real complexity hotspot beneath the minimal public surface ^[27].
• Supply-chain posture can't be fully verified from this audit. No lockfile is committed and the CVE scan failed to run, so critical/high vulnerability counts against the (admittedly zero-dependency) dev toolchain are unknown rather than confirmed clean ^[28].

A lean, well-documented fetch wrapper with fast maintenance turnaround, weakened by thin PR review discipline and an unverified CVE posture.

Comparable minimal fetch wrappers include wretch and axios (heavier, more deps); ky's zero-runtime-dependency stance is the main differentiator here.