GHSA-57cf-349j-352g: Out-of-bounds Read in npmconf

The vulnerability stems from unsafe Buffer initialization when processing numeric input in Node.js 4.x. Since npmconf handles configuration serialization, the save method in its Config class is the most probable location where data gets written to disk. The description explicitly calls out numeric type handling and uninitialized memory exposure, which aligns with deprecated new Buffer(size) usage. While the exact code changes aren't visible, the pattern matches known Buffer-related vulnerabilities fixed by replacing new Buffer() with Buffer.alloc().