
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@deepsalunkhee/hasher
Advanced tools
The code defines two arrays of constants:
The code defines several helper functions:
Pre-processing: The input message is divided into 64-byte (512-bit) chunks. Each chunk is further divided into 4-byte words, and the character codes of each character in the chunk are stored as Uint8Array.
Padding: The message is padded to ensure its length is a multiple of 512 bits (64 bytes). A single '1' bit is appended to the message, followed by '0' bits until the length is 64 bits less than a multiple of 512. The original length of the message (in bits) is then appended as a 64-bit big-endian integer.
Main Computation: The code iterates over each 512-bit block of the padded message. For each block, it prepares the message schedule by expanding the block into an array of 64 32-bit words (w). It then initializes eight working variables (a to h) with the initial hash values (H). The main loop of the SHA-256 algorithm is executed, where each round involves updating the working variables based on the message schedule and the constants (K). After processing all blocks, the final hash values (H) are updated. Conversion to Hexadecimal String:
The final hash values are converted to a hexadecimal string representation. Each 32-bit hash value is converted to an 8-character hexadecimal string using toString(16), ensuring each value is represented with leading zeros if necessary. Return Value:
The function returns the computed hash as a hexadecimal string.
FAQs
A simple Hashing lib
We found that @deepsalunkhee/hasher demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.