JavaScript instanceOf and different versions of the underlying Encryption SDK modules.

We use instanceOf to insure some security properties of Cryptographic Materials, and Encrypted Data Keys. However, under some conditions, versions of the dependent packages may result in copies of these files being installed (local node_modules folders) for the packages that have differing versions.
This means that these instanceOf checks may fail. Because while the code is the same, the actual instances are not.
What is the best direction?
How pervasive can this be?

Trace the instanceOf checks involving Cryptographic Materials and Encrypted Data Keys, then inspect how differing dependency versions create local node_modules copies. Determine how pervasive the identity mismatch can be and document a concrete direction with tests or reproduction cases showing the expected security behavior.

Vom Indexierungsmodell aus dem Issue-Text verfasst.