bigint-buffer

bigint to buffer conversion with native support

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): Install script runs node-gyp rebuild for native N-API bindings with graceful fallback — standard pattern for this native addon package.	ai	2026/04/25
semgrep	semgrep:hex-decode	AI (semgrep): All hex-decode findings are in benchmark/test files using literal hex strings like 'deadbeef' for test data, not obfuscated payloads.	ai	2026/04/25
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is in a test spec file loading the built dist directory — not production code, no arbitrary module loading risk.	ai	2026/04/25

Version	Deps	Published