@better-auth/utils - npm Package Compare versions

Comparing version 0.4.1 to 0.4.2

dist/otp.cjs

@@ -11,2 +11,9 @@ 'use strict';
 const defaultDigits = 6;
+function constantTimeEqualOTP(input, expected) {
+  let difference = input.length ^ expected.length;
+  for (let i = 0; i < expected.length; i++) {
+    difference |= input.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return difference === 0;
+}
 async function generateHOTP(secret, {
@@ -45,2 +52,3 @@ counter,
   const counter = Math.floor(Date.now() / milliseconds);
+  let matched = false;
   for (let i = -window; i <= window; i++) {
@@ -51,7 +59,5 @@ const generatedOTP = await generateHOTP(secret, {
     });
-    if (otp === generatedOTP) {
-      return true;
-    }
+    matched = constantTimeEqualOTP(otp, generatedOTP) || matched;
   }
-  return false;
+  return matched;
 }
@@ -58,0 +64,0 @@ function generateQRCode({

dist/otp.mjs

@@ -9,2 +9,9 @@ import { base32 } from './base32.mjs';
 const defaultDigits = 6;
+function constantTimeEqualOTP(input, expected) {
+  let difference = input.length ^ expected.length;
+  for (let i = 0; i < expected.length; i++) {
+    difference |= input.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return difference === 0;
+}
 async function generateHOTP(secret, {
@@ -43,2 +50,3 @@ counter,
   const counter = Math.floor(Date.now() / milliseconds);
+  let matched = false;
   for (let i = -window; i <= window; i++) {
@@ -49,7 +57,5 @@ const generatedOTP = await generateHOTP(secret, {
     });
-    if (otp === generatedOTP) {
-      return true;
-    }
+    matched = constantTimeEqualOTP(otp, generatedOTP) || matched;
   }
-  return false;
+  return matched;
 }
@@ -56,0 +62,0 @@ function generateQRCode({

package.json

 {
   "name": "@better-auth/utils",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "license": "MIT",
@@ -18,3 +18,3 @@ "description": "A collection of utilities for better-auth",
     "type": "git",
-    "url": "https://github.com/better-auth/utils"
+    "url": "git+https://github.com/better-auth/utils.git"
   },
@@ -98,4 +98,5 @@ "devDependencies": {
     "build": "unbuild",
+    "bump": "bumpp",
     "lint:fix": "biome check . --write"
   }
 }

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Improved metrics

Total package byte prevSize

77228

0.76%

Lines of code

1552

0.78%

Number of medium supply chain risk alerts

0

-100%

No dependency changes