npm / safer-buffer / 2.1.2

safer-buffer 2.1.2

Source

https://github.com/ChALkeR/safer-buffer

Tag scanned

v2.1.2

Compared with

v2.1.1 (0 signals introduced since)

Files

6 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

5.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 19:00

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review unicode-homoglyph Readme.md:71:9

   identifier `identiсal` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)

   See the problem? Adding in `safe-buffer` _magically removes the lint warning_, but the behavior
   remains identiсal to what we had before, and when launched on Node.js 6.x LTS — this dumps out
   chunks of uninitialized memory.
   _And this code will still emit runtime warnings on Node.js 10.x and above._

   likely benign LLM, confidence 0.80 A Cyrillic homoglyph appears in the word 'identical' within a README explanation of safe-buffer behavior.

   Reasoning

   The Cyrillic 'с' in 'identiсal' sits in prose inside a markdown README, not in executable code. It looks like an accidental copy or typing artifact in documentation. The surrounding text is an ordinary technical explanation of a lint warning and Node.js behavior, so the homoglyph is not being used to hide or disguise anything that runs.

2. info warn → info by review unicode-mixed-script Readme.md:71:9

   identifier `identiсal` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

   See the problem? Adding in `safe-buffer` _magically removes the lint warning_, but the behavior
   remains identiсal to what we had before, and when launched on Node.js 6.x LTS — this dumps out
   chunks of uninitialized memory.
   _And this code will still emit runtime warnings on Node.js 10.x and above._

   likely benign LLM, confidence 0.80 The same Cyrillic-in-Latin word 'identiсal' in the README is flagged as mixed-script.

   Reasoning

   This is the same homoglyph as the first finding, reported as a mixed-script identifier. The token is English prose in a markdown document rather than a code identifier, and nothing in the snippet executes or conceals behavior. It is most plausibly an accidental character substitution, not an attack.

3. info warn → info by review dynamic-attribute safer.js:61:30

   `process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)

     try {
       safer.kStringMaxLength = process.binding('buffer').kStringMaxLength
     } catch (e) {
       // we can't determine kStringMaxLength in environments where process.binding

   likely benign LLM, confidence 0.85 Reads Node's internal buffer binding to learn kStringMaxLength for cross-version compatibility.

   Reasoning

   The code reads kStringMaxLength from process.binding('buffer') inside a try/catch, with a comment about environments where the binding is unavailable. This is a known compatibility shim in safer-buffer that determines the maximum string length on older Node versions. process.binding is deprecated but is used here for a legitimate, documented purpose, not to run hidden payloads.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/ChALkeR/safer-buffer safer-buffer && cd safer-buffer
git checkout v2.1.2
disclude scan --severity info --diff v2.1.1 .