helmetjs/helmet

    for (const element of directiveValue) {
      if (typeof element !== "string") continue;

and later, at line 194:

    result.set(directiveName, directiveValue);

The public type accepts any Iterable as a directive value, and the README says "an array (or other iterable)". At setup time, parseDirectives loops over the caller's iterable to validate it, then stores that same object. Arrays and Sets survive a second pass, but a generator or any other single-use iterator does not. It is exhausted by validation. Because it is neither an Array nor a Set, the precomputed fast path is skipped, and on every request getHeaderValue (line 235) loops over the already-empty iterator. The header then carries the directive with no sources (for example a bare script-src), which blocks every script on the site. No error is raised, so the failure is silent and hard to trace. The existing test at test/content-security-policy.test.ts:166 uses an iterator that is empty from the start, so it cannot catch this.

In parseDirectives, copy non-string values once (directiveValue = Array.from(rawDirectiveValue)), then validate and store the copy. That way the fast path, the per-request path and validation all see the same values. Add a test that passes a generator with at least one value, such as function* () { yield "'self'"; }(), and checks that the value appears in the header on two consecutive requests.

      console.warn(
        "Origin-Agent-Cluster does not take options. Remove the property to silence this warning.",
      );

Five middlewares (Origin-Agent-Cluster, X-Content-Type-Options, X-Download-Options, X-Powered-By, X-XSS-Protection) each carry their own copy of the same "warn, then install the default" branch. If the wording or behaviour changes, for example to throw in a future major version or to warn only once, all five copies have to be edited together, and they can drift apart.

Add one small helper, for example warnTakesNoOptions(headerName), and call it from each of the five default: branches. Leave the per-middleware switch blocks as they are.

  const { stdout } = await exec("npm run build");

  const middlewareToBuild = process.argv[2];
  buildAndPack(middlewareToBuild)

The build script can produce a separate npm package for each middleware (for example helmet-csp). It combines the shared build code, the middleware entry file and that middleware's package-overrides.json. The test suite and the CI workflow only build and install the main helmet package, never with a middleware argument. We searched package.json, .github/workflows/nodejs.yml and the tests and found no other caller. A broken override file, a CommonJS-only bundle problem or a wrong exports map in one of the standalone packages would therefore only surface after it is published. We did not find a broken package today, so this is graded as a verification gap.

Add a test or a CI matrix step that runs the build for every middlewares/* directory that has a package-overrides.json. Install each tarball into a throwaway CommonJS project and assert that the expected header is set. Also check the generated package.json fields (name, version, main, types).