bigint-buffer-js

Drop-in replacement for [email protected] without the native binding.

bigint-buffer ≤ 1.1.5 has a buffer overflow in the native toBigIntLE() (CVE-2025-3194 / GHSA-3gc7-fjrx-p6mg) and no fixed version has been published. It is pulled in transitively by @solana/buffer-layout-utils → @solana/spl-token.

This package keeps the exact same API and the pure JavaScript code path of the original (toBigIntLE, toBigIntBE, toBufferLE, toBufferBE), with no bindings require and no node-gyp rebuild on install.

Proof of equivalence

npm test compares every function against a verbatim copy of [email protected]/dist/browser.js (referencia-bigint-buffer-1.1.5-browser.js) on 20,046 checks: random buffers of 0–64 bytes, truncation/padding widths, edge values up to 2^256−1 and u64 round-trips.

Use (npm overrides)

"overrides": { "bigint-buffer": "github:disley15-collab/bigint-buffer-js#<commit>" }

Pin to a commit hash.

License

Apache-2.0 (same as the original). See NOTICE.