npm / safer-buffer / 2.1.2

safer-buffer 2.1.2

Source

https://github.com/ChALkeR/safer-buffer

Artifact scanned

safer-buffer-2.1.2.tgz (npm tarball · 11.8 KB · SHA-256 78812f65ae3b…)

Compared with

safer-buffer-2.1.1.tgz (0 signals introduced since)

Files

6 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 3 info

Scan time

4.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-23 22:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review unicode-homoglyph Readme.md:71:9

   identifier `identiсal` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)

   See the problem? Adding in `safe-buffer` _magically removes the lint warning_, but the behavior
   remains identiсal to what we had before, and when launched on Node.js 6.x LTS — this dumps out
   chunks of uninitialized memory.
   _And this code will still emit runtime warnings on Node.js 10.x and above._

   likely benign LLM, confidence 0.80 A Cyrillic 'с' appears in the word 'identical' in the safe-buffer README's explanatory text.

   Reasoning

   The homoglyph is a Cyrillic 'с' inside prose in a markdown README, not in executable code. It reads as an accidental typo or copy-paste artifact in documentation and does not hide any behavior.

2. info warn → info by review unicode-mixed-script Readme.md:71:9

   identifier `identiсal` mixes scripts: Latin + Cyrillic (raw pass, confidence 0.80)

   See the problem? Adding in `safe-buffer` _magically removes the lint warning_, but the behavior
   remains identiсal to what we had before, and when launched on Node.js 6.x LTS — this dumps out
   chunks of uninitialized memory.
   _And this code will still emit runtime warnings on Node.js 10.x and above._

   likely benign LLM, confidence 0.80 The same word in the README mixes Latin and Cyrillic characters, a documentation typo.

   Reasoning

   This is the same single word in the README prose, flagged again for mixed Latin and Cyrillic script. It is a documentation typo with no bearing on code execution.

3. info warn → info by review dynamic-attribute safer.js:61:30

   `process.binding(...)` reaches Node internal bindings (ast pass, confidence 0.80)

     try {
       safer.kStringMaxLength = process.binding('buffer').kStringMaxLength
     } catch (e) {
       // we can't determine kStringMaxLength in environments where process.binding

   likely benign LLM, confidence 0.85 Reads the buffer module's kStringMaxLength through process.binding inside a guarded try block to support older Node versions.

   Reasoning

   This is the safer-buffer compatibility shim. It reads kStringMaxLength from process.binding('buffer') inside a try/catch, with a comment explaining it is needed for environments where the value cannot be determined. The access is deprecated but used for a legitimate, documented purpose, with no decoding, network, or process spawning.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o safer-buffer-2.1.2.tgz https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz
printf '%s  %s\n' 78812f65ae3b98071ce1c9bacbe0666f4220d0b2753c2a11530eb27df440a3b3 safer-buffer-2.1.2.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf safer-buffer-2.1.2.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg