
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@hpke/dhkem-x448
Advanced tools
Documentation: jsr.io | pages (only for the latest ver.)
@hpke/dhkem-x448
need to be used with
@hpke/core,
which can be installed in the same manner as desribed below.
You can install the package with npm, yarn or pnpm.
# Using npm:
npm install @hpke/dhkem-x448
yarn add @hpke/dhkem-x448
pnpm install @hpke/dhkem-x448
# Using jsr:
npx jsr add @hpke/dhkem-x448
yarn dlx jsr add @hpke/dhkem-x448
pnpm dlx jsr add @hpke/dhkem-x448
The above manner can be used with other JavaScript runtimes that support npm, such as Cloudflare Workers and Bun.
Then, you can use the module from code like this:
import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
import { DhkemX448HkdfSha512 } from "@hpke/dhkem-x448";
For Deno, it is recommended to use the jsr.io registry.
deno add jsr:@hpke/dhkem-x448
Followings are how to use this module with typical CDNs. Other CDNs can be used as well.
Using esm.sh:
<!-- use a specific version -->
<script type="module">
import {
Aes256Gcm,
CipherSuite,
HkdfSha256,
} from "https://esm.sh/@hpke/core@<SEMVER>";
import {
DhkemX448HkdfSha512,
} from "https://esm.sh/@hpke/dhkem-x448@<SEMVER>";
// ...
</script>
<!-- use the latest stable version -->
<script type="module">
import * as hpke from "https://esm.sh/@hpke/core";
import * as x448 from "https://esm.sh/@hpke/dhkem-x448";
// ...
</script>
Using unpkg:
<!-- use a specific version -->
<script type="module">
import {
Aes256Gcm,
CipherSuite,
HkdfSha256,
} from "https://unpkg.com/@hpke/core@<SEMVER>/esm/mod.js";
import {
DhkemX448HkdfSha512,
} from "https://unpkg.com/@hpke/dhkem-x448@<SEMVER>/esm/mod.js";
// ...
</script>
This section shows some typical usage examples.
import { Aes256Gcm, CipherSuite, HkdfSha512 } from "@hpke/core";
import { DhkemX448HkdfSha512 } from "@hpke/dhkem-x448";
// const { DhkemX448HkdfSha512 } = require("@hpke/dhkem-x448");
async function doHpke() {
// setup
const suite = new CipherSuite({
kem: new DhkemX448HkdfSha512(),
kdf: new HkdfSha512(),
aead: new Aes256Gcm(),
});
const rkp = await suite.kem.generateKeyPair();
const sender = await suite.createSenderContext({
recipientPublicKey: rkp.publicKey,
});
// encrypt
const ct = await sender.seal(new TextEncoder().encode("Hello world!"));
const recipient = await suite.createRecipientContext({
recipientKey: rkp.privateKey,
enc: sender.enc,
});
// decrypt
const pt = await recipient.open(ct);
// Hello world!
console.log(new TextDecoder().decode(pt));
}
try {
doHpke();
} catch (err) {
console.log("failed:", err.message);
}
import { Aes256Gcm, CipherSuite, HkdfSha512 } from "@hpke/core";
import { DhkemX448HkdfSha512 } from "@hpke/dhkem-x448";
async function doHpke() {
// setup
const suite = new CipherSuite({
kem: new DhkemX448HkdfSha512(),
kdf: new HkdfSha512(),
aead: new Aes256Gcm(),
});
const rkp = await suite.kem.generateKeyPair();
const sender = await suite.createSenderContext({
recipientPublicKey: rkp.publicKey,
});
// encrypt
const ct = await sender.seal(new TextEncoder().encode("Hello world!"));
const recipient = await suite.createRecipientContext({
recipientKey: rkp.privateKey,
enc: sender.enc,
});
// decrypt
const pt = await recipient.open(ct);
// Hello world!
console.log(new TextDecoder().decode(pt));
}
try {
doHpke();
} catch (_err: unknown) {
console.log("failed.");
}
<html>
<head></head>
<body>
<script type="module">
import {
Aes256Gcm,
CipherSuite,
HkdfSha512,
} from "https://esm.sh/@hpke/core>";
import { DhkemX448HkdfSha512 } from "https://esm.sh/@hpke/dhkem-x448";
globalThis.doHpke = async () => {
try {
const suite = new CipherSuite({
kem: new DhkemX448HkdfSha512(),
kdf: new HkdfSha512(),
aead: new Aes256Gcm(),
});
const rkp = await suite.kem.generateKeyPair();
const sender = await suite.createSenderContext({
recipientPublicKey: rkp.publicKey,
});
// encrypt
const ct = await sender.seal(
new TextEncoder().encode("Hello world!"),
);
const recipient = await suite.createRecipientContext({
recipientKey: rkp.privateKey, // rkp (CryptoKeyPair) is also acceptable.
enc: sender.enc,
});
// decrypt
const pt = await recipient.open(ct);
// Hello world!
alert(new TextDecoder().decode(pt));
} catch (err) {
alert("failed:", err);
}
};
</script>
<button type="button" onclick="doHpke()">do HPKE</button>
</body>
</html>
We welcome all kind of contributions, filing issues, suggesting new features or sending PRs.
FAQs
A Hybrid Public Key Encryption (HPKE) module extension for X448
The npm package @hpke/dhkem-x448 receives a total of 19,455 weekly downloads. As such, @hpke/dhkem-x448 popularity was classified as popular.
We found that @hpke/dhkem-x448 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.