@libit/bufio

Buffer and serialization utilities for javascript

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:hex-decode	AI (semgrep): Buffer serialization library legitimately decodes hex strings as core functionality; this is not a malicious payload pattern.	ai	2026/04/21
semgrep	semgrep:base64-decode	AI (semgrep): Buffer serialization library legitimately decodes base64 strings as core functionality; this is not a malicious payload pattern.	ai	2026/04/21
provenance	no-provenance	AI (provenance): Absence of Sigstore provenance is common and not a security risk for this well-established package with a clean publisher history.	ai	2026/04/21

Version	Deps	Published
0.4.2	1 / 4	2021-08-01
0.4.1	1 / 4	2021-07-29
0.3.0	1 / 4	2021-07-27
0.2.10	1 / 4	2021-07-27
0.2.9	1 / 4	2021-07-15
0.2.8	1 / 4	2021-07-02
0.2.7	1 / 4	2021-07-01
0.2.6	1 / 4	2021-06-24
0.2.5	1 / 4	2021-06-23
0.2.4	1 / 4	2021-06-20
0.2.3	1 / 4	2021-06-18
0.2.2	1 / 4	2021-06-17
0.2.1	1 / 4	2021-06-17
0.2.0	1 / 4	2021-06-17