
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@cmdcode/crypto-utils
Advanced tools
Wraps the @noble/curves/secp256k1 library and provides a simpler API.
Everything is fully-typed and straight-forward to use. More documentation coming soon!
Example import into a browser-based project:
<script src="https://unpkg.com/@cmdcode/crypto-utils"></script>
<script> const { Field, Point, SecretKey, PublicKey } = window.cryptoUtils </script>
Example import into a commonjs project:
const { Field, Point, SecretKey, PublicKey } = require('@cmdcode/crypto-utils')
Example import into an ES module project:
import { Field, Point, SecretKey, PublicKey } from '@cmdcode/crypto-utils'
// Fields can be created from a variety of types (strings are treated as hex).
type FieldValue = string | number | bigint | Uint8Array | Field
// Points can be created from a variety of types (strings are treated as hex).
type PointValue = string | number | bigint | Uint8Array | Point
class Field extends Uint8Array {
// Prime N reference.
static N: bigint;
// Helper method for efficient modulo operations.
static mod(x: bigint, n?: bigint): bigint;
// Helper method for efficient power operations.
static pow(x: bigint, e: bigint, n?: bigint): bigint;
// Normalize input values into bytes.
static normalize(num: FieldValue): Uint8Array;
// Validate input values (or throw).
static validate(num: bigint): boolean;
// Accepts a variety of inputs.
constructor(x : FieldValue);
// Convert into a variety of formats.
get buff() : Buff;
get raw() : Uint8Array;
get big() : bigint;
get hex() : string;
// Return point (or x-only point) object.
get point() : Point;
get xpoint() : Point;
// Helper attributes.
get hasOddY() : boolean;
get negated() : Field;
// All basic operations are available.
gt(big: FieldValue) : boolean;
lt(big: FieldValue) : boolean;
eq(big: FieldValue) : boolean;
ne(big: FieldValue) : boolean;
add(big: FieldValue) : Field;
sub(big: FieldValue) : Field;
mul(big: FieldValue) : Field;
pow(big: FieldValue) : Field;
div(big: FieldValue) : Field;
negate() : Field;
generate() : Point;
}
class Point {
// Prime N reference.
static N: bigint;
// Validate input values (or throw).
static validate(x: PointValue): boolean;
// Normalize input values into bytes.
static normalize(x: PointValue): ECPoint;
// Generate a point from a field (scalar) value.
static generate(value: FieldValue): Point;
// Helper method for importing coordinates.
static import(point: Point | ECPoint): Point;
// Accepts a varity of x-only and compressed key inputs.
// Will also accept coordinate data (as bigint).
constructor(x: PointValue, y?: bigint);
// Convert into a variety of formats.
get p() : ECPoint;
get x() : Buff;
get y() : Buff;
get buff() : Buff; // Returns compressed key.
get raw() : Uint8Array; // Returns compressed key.
get hex() : string; // Returns compressed key.
// Helper attributes.
get hasEvenY(): boolean;
get hasOddY(): boolean;
// Basic math operations available.
eq(value: PointValue): boolean;
add(x: PointValue): Point;
sub(x: PointValue): Point;
mul(value: PointValue): Point;
negate(): Point;
}
class SecretKey extends Uint8Array {
static random(opt?: KeyOptions): SecretKey;
constructor(secret: Bytes, options?: KeyOptions);
get buff(): Buff;
get raw(): Uint8Array;
get hex(): string;
get field(): Field;
get point(): Point;
get pub(): PublicKey;
get hasEvenY(): boolean;
get hasOddY(): boolean;
get xfilter(): SecretKey;
add(bytes: Bytes): SecretKey;
sub(bytes: Bytes): SecretKey;
mul(bytes: Bytes): SecretKey;
div(bytes: Bytes): SecretKey;
pow(bytes: Bytes): SecretKey;
negate(): SecretKey;
sign(message: Bytes, type?: SignatureType): Uint8Array
verify(signature: Bytes, message: Bytes, type?: SignatureType): boolean
toWIF(prefix?: number): string;
}
class PublicKey extends Uint8Array {
static random(opt: KeyOptions): PublicKey;
static fromSecret(bytes: Bytes, opt: KeyOptions): PublicKey;
constructor(pubkey: Bytes, options?: KeyOptions);
get buff(): Buff;
get raw(): Uint8Array;
get hex(): string;
get point(): Point;
get x(): Buff;
get y(): Buff;
get hasEvenY(): boolean;
get hasOddY(): boolean;
add(bytes: Bytes): PublicKey;
sub(bytes: Bytes): PublicKey;
mul(bytes: Bytes): PublicKey;
negate(): PublicKey;
verify(signature: Bytes, message: Bytes, type?: SignatureType): boolean
}
You can also import the following hash methods:
import {
sha256,
sha512,
ripe160,
hash160,
hash256,
hmac256,
hmac512
} from '@cmdcode/crypto-utils'
This library uses yarn for package management, tape for writing tests, and rollup for cross-platform releases. Here are a few scripts that are useful for development.
## Compiles types and builds release candidates in /dist folder.
yarn build
## Run any typescript file using real-time compilation.
yarn start contrib/example.ts
## Runs all tests listed in test folder.
yarn test
## Full macro script for generating a new release candidate.
yarn release
If you run into any bugs or have any questions, please submit an issue ticket.
Feel free to fork and make contributions. Suggestions are welcome!
Use this library however you want!
FAQs
Simple library for using secp256k1 cryptography.
We found that @cmdcode/crypto-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.