npm / safer-buffer / 2.1.2

safer-buffer 2.1.2

Source

https://github.com/ChALkeR/safer-buffer

Tag scanned

v2.1.2

Compared with

v2.1.1 (0 signals introduced since)

Files

6 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

5.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 20:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review unicode-homoglyph Readme.md:71:9

   identifier `identiсal` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)

   See the problem? Adding in `safe-buffer` _magically removes the lint warning_, but the behavior
   remains identiсal to what we had before, and when launched on Node.js 6.x LTS — this dumps out
   chunks of uninitialized memory.
   _And this code will still emit runtime warnings on Node.js 10.x and above._

   likely benign LLM, confidence 0.80 A Cyrillic 'с' replaces a Latin 'c' in the word 'identical' in a README paragraph.

   Reasoning

   The Cyrillic 'с' in 'identiсal' sits in prose inside a Markdown README, not in executable code. It has no runtime effect and looks like an accidental copy-paste or typo in documentation, though it is a real homoglyph.

2. info warn → info by review unicode-mixed-script Readme.md:71:9

   identifier `identiсal` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

   See the problem? Adding in `safe-buffer` _magically removes the lint warning_, but the behavior
   remains identiсal to what we had before, and when launched on Node.js 6.x LTS — this dumps out
   chunks of uninitialized memory.
   _And this code will still emit runtime warnings on Node.js 10.x and above._

   likely benign LLM, confidence 0.80 The same 'identiсal' word mixes Latin and Cyrillic characters in a README paragraph.

   Reasoning

   This is the same homoglyph reported a second time as a mixed-script signal. It is confined to Markdown prose and has no execution path, so it reflects the same likely accidental typo.

3. info warn → info by review dynamic-attribute safer.js:61:30

   `process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)

     try {
       safer.kStringMaxLength = process.binding('buffer').kStringMaxLength
     } catch (e) {
       // we can't determine kStringMaxLength in environments where process.binding

   likely benign LLM, confidence 0.85 Reads the kStringMaxLength constant from Node's internal buffer binding inside a try/catch to set a compatibility value.

   Reasoning

   In safer-buffer's safer.js, process.binding('buffer') is read inside a try/catch to determine kStringMaxLength, with a fallback for environments where the binding is unavailable. The code only reads a numeric constant and is a known, documented pattern in that library. Using the deprecated process.binding is unusual but not malicious.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/ChALkeR/safer-buffer safer-buffer && cd safer-buffer
git checkout v2.1.2
disclude scan --severity info --diff v2.1.1 .