“Strip UTF-8 byte order mark (BOM) from a string/buffer/stream”
Local reference
Suspicious dependency
Inferred
Mal-ecule
H₂(FPo₂)Md(Pa₄)
Referenced by 9 samples
- benign rucksack-css-1.0.2.tgz fetched
- benign fomantic-ui-2.9.4.tgz fetched
- benign split-test-for-elementor-1.9.3.zip fetched
- benign github.com-adobe-React-spectrum-v2.9.0+incompatible.zip fetched
- benign superagent-3.8.1.tgz fetched
- benign postcss-alias-2.0.0.tgz fetched
- suspicious github.com-davidtranhq-mathjs-v3.18.1+incompatible.zip fetched
- benign laggard-2.0.1.tgz fetched
- benign postcss-responsive-type-1.0.0.tgz fetched
Objectives
component severity, 80% confident.
supply-chain/install-hook/package
Repository uses GitHub shorthand format
Micro-behaviors
notable severity, 70% confident.
fs/file
Creates a file read stream
notable severity, 80% confident.
process/fd
Pipes a Node standard stream
notable severity, 80% confident.
process/io
References Node.js stdout stream
baseline severity, 80% confident.
data/source/syntax
Reads an array element into a variable
baseline severity, 80% confident.
process/info
Reads Node.js arguments through process.argv
Metadata
notable severity, 70% confident.
package/dependencies
npm devDependency pinned to '*'
notable severity, 92% confident.
package/files
Package.json declares a files allowlist
notable severity, 90% confident.
package/manifest
Repository uses owner/project coordinate
notable severity, 90% confident.
package/manifest/author
Package declares Sindre Sorhus email
baseline severity, 80% confident.
file/profile
Contains common English function words
baseline severity, 70% confident.
import
Imports the Node.js fs module
baseline severity, 100% confident.
package
package.json defines a package version
baseline severity, 100% confident.
package/quality
package.json defines a package name
component severity, 90% confident.
file
File has 30 or more lines
Identity
| SHA-256 | e093942ea7c12af2e0236ec9e93f2759919a1bfb099c53ce6ce8961b0ef108ac |
|---|---|
| Canonical SHA-256 | 3579e9683c8396c161497dbb37ce2f9f81d79b7fb162398860c766a9dde203b8 |
| Filename | [email protected] |
| Package | strip-bom |
| Version | 1.0.0 |
| PURL | pkg:npm/[email protected] |
Origin
| Source | x |
|---|---|
| Feed | wordpress.org |
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/strip-bom/-/strip-bom-1.0.0.tgz |
Timeline
| First seen | 10 Aug 2026 16:10 UTC |
|---|---|
| First analyzed | 10 Aug 2026 16:12 UTC |
| Last analyzed | 23 Aug 2026 16:19 UTC |
| Last updated | 23 Aug 2026 16:20 UTC |
Labeling
| Label | unknown |
|---|---|
| Traits version | 63cf1 |
Not seeing what you expected? Let us know