Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@coboxcoop/crypto
Advanced tools
CoBox is an encrypted p2p file system and distributed back-up tool. README provides a map of the project.
crypto
provides the crypto primitives used in CoBox
npm i -g @coboxcoop/crypto
const crypto = require('@coboxcoop/crypto')
const address = crypto.address()
Returns a ed25519
random 32 byte buffer
const keyPair = crypto.keyPair()
Returns an ed25519
keypair that can used for tree signing.
const encKey = crypto.encryptionKey()
Returns an ed25519
symmetric key used for shared secret encryption
const accessKey = crypto.accessKey()
// OR
const accessKey = crypto.pack(address, encKey)
Returns an access key, which consists of an ed25519
address, packed together with an ed25519
symmetric key
const keys = crypto.unpack(key)
Returns an object containing an address, and a shared secret if accessible. Address alone is used for blind replication. The shared secret can then be used for decryption.
const { publicKey, secretKey } = crypto.boxKeyPair(seed)
Returns an ed25519
private box keypair used for identification, message signing and encryption
const boxed = box(publicKey, message, [context])
Encrypts a message to a given public key and returns it as a buffer
publicKey
buffer or hex encoded stringmessage
buffer or hex encoded string of any lengthcontext
, if passed, will be hashed in to the shared secret. Should be a buffer or hex encoded string.const unboxed = unbox(cipherText, keypair, [context])
Decrypts a message using the given keypair.
cipherText
the encrypted message given as a buffer.keypair
an object of the form { publicKey, secretKey }
both of which should be buffers or hex encoded strings.context
, if given, will be hashed into the shared secret. Should be a buffer or hex encoded string.PRs accepted.
Small note: If editing the README, please conform to the standard-readme specification.
FAQs
crypto library for generating keys using libsodium
We found that @coboxcoop/crypto demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.