← Home

bufferstream

npm Repository Homepage

painless stream buffering and cutting

5
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

dodo

Keywords

bufferbuffersstreamstreams

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff source-size-tripled AI (source-diff): Package is a native addon (node-waf build); size increase from 362B to 6KB is consistent with compiled output or legitimate source expansion, not injected payload. ai
install-scripts install-script:preinstall AI (install-scripts): Preinstall script is a literal no-op comment (#preinstall DO NOTHING). No code execution risk. Stable across all versions of this package. ai
install-scripts install-script:install AI (install-scripts): Install script runs node-waf configure build — the standard Node.js 0.4.x era native addon build tool. Legitimate native C++ binding build step, consistent across all versions. ai
phantom-deps phantom-dep:buffertools AI (phantom-deps): buffertools is a native addon dependency used at build/link time; not directly imported in JS but legitimately declared. Stable pattern for this package. ai
phantom-deps phantom-dep:coffee-script AI (phantom-deps): coffee-script is a build-time toolchain dependency for this legacy package. Not directly imported in JS but legitimately declared. ai
semgrep semgrep:child-process-import AI (semgrep): The child_process spawn import appears in a test/example file with a hardcoded local path. Not a malicious use; stable false positive for this package. ai

Versions (showing 5 of 5)

Version Deps Published
0.6.1 2 / 5
0.4.3 2 / 2
0.4.1 2 / 2
0.1.6 2 / 0
0.1.4 2 / 0

v0.6.1

2 findings
HIGH Unclaimed maintainer email domain: blacksec.org email-domain

Maintainer email '[email protected]' uses domain 'blacksec.org' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.3

4 findings
HIGH Package has 'preinstall' script install-scripts

Script: #preinstall DO NOTHING

HIGH Package has 'install' script install-scripts

Script: node-waf configure build

HIGH Unclaimed maintainer email domain: blacksec.org email-domain

Maintainer email '[email protected]' uses domain 'blacksec.org' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

4 findings
HIGH Package has 'preinstall' script install-scripts

Script: #preinstall DO NOTHING

HIGH Package has 'install' script install-scripts

Script: node-waf configure build

HIGH Unclaimed maintainer email domain: blacksec.org email-domain

Maintainer email '[email protected]' uses domain 'blacksec.org' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.6

3 findings
HIGH Package has 'preinstall' script install-scripts

Script: #preinstall DO NOTHING

HIGH Package has 'install' script install-scripts

Script: node-waf configure build

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.