
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@refreshjs/puidv7
Advanced tools
This package (@refreshjs/puidv7) is deprecated. Please use the new package:
npm install puidv7
This library helps with generating, encoding, and parsing a puidv7.
You can continue to store IDs as UUIDv7 in your database, using the included Drizzle ORM custom type. There are helpers for converting to/from UUID format.
It's a prefixed UUIDv7 which:
Check out the online converter at https://refreshjs.org/puidv7 or step through the following examples...
With acc prefix:
UUIDv7 = 01970a1c-e31e-7422-9cd5-e9651d11cc97
puidv7 = acc06bgm7733st2576nx5jht4ecjw
How to manually verify:
Remove dashes from the UUIDv7 to get the HEX-encoded string
e.g. 01970a1c-e31e-7422-9cd5-e9651d11cc97 becomes 01970a1ce31e74229cd5e9651d11cc97
Convert the HEX-encoded string to crockford base32 e.g. Use https://cryptii.com/pipes/crockford-base32 with Bytes (in Hexadecimal format), and Encode to Base32 (Crockford's Base32 variant).
i.e. 01970a1ce31e74229cd5e9651d11cc97 becomes 06BGM7733ST2576NX5JHT4ECJW
Convert the value to lowercase and add the prefix.
e.g. 06BGM7733ST2576NX5JHT4ECJW becomes 06bgm7733st2576nx5jht4ecjw
then 06bgm7733st2576nx5jht4ecjw becomes acc06bgm7733st2576nx5jht4ecjw
Because:
Advantages of the human-friendly puidv7 format:
We aim to use minimal packages but have opted for:
This is both a TypeScript and Go package.
If you would like to use puidv7 in Go with a github.com/go-playground/validator/v10 validator:
func ValidatePuidv7(fl validator.FieldLevel) bool {
_, err := puidv7.Decode(fl.Field().String(), "")
if err != nil {
return false
}
return true
}
func Example() {
validate := validator.New(validator.WithRequiredStructEnabled())
if err := validate.RegisterValidation("puidv7", ValidatePuidv7); err != nil {
fmt.Printf("error registering puidv7 validator: %v\n", err)
}
if err := validate.Struct(struct {
ID string `validate:"required,puidv7"`
}{
ID: "abc06awcb4f5hzmfey7qwt7s8a6q4",
}); err != nil {
fmt.Printf("validation errors: %+s\n", err)
}
}
Thank you to Nadrama.com for sponsoring this work!
Please reach out to Nadrama or @ryan0x44 if you have any security related questions or concerns
FAQs
Prefixed UUIDv7's in crockford base32 encoding
We found that @refreshjs/puidv7 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.