Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
@nlv8/signun
Advanced tools
signun provides sync and async N-API bindings to the following crypto libraries:
privateKeyVerify
,publicKeyCreate
,sign
verify
.Install with npm or yarn:
npm i @nlv8/signun --save
yarn add @nlv8/signun
Please keep in mind, that you must have GMP installed (signun will not fallback to JS-only implementations).
const { randomBytes } = require('crypto');
const { secp256k1 } = require('@nlv8/signun');
let privateKey;
do {
privateKey = randomBytes(32)
} while (!secp256k1.privateKeyVerifySync(privateKey));
const publicKey = secp256k1.publicKeyCreateSync(privateKey);
const message = randomBytes(32);
const signOptions = {
// 32 bytes of custom data.
data: null,
// Custom nonce function.
noncefn: null
}
const signResult = secp256k1.signSync(message, privateKey, signOptions);
const verifyResult = secp256k1.verifySync(message, signResult.signature, publicKey);
console.log(verifyResult);
const { randomBytes } = require('crypto');
const { secp256k1 } = require('@nlv8/signun');
(async function main() {
let privateKey;
do {
privateKey = randomBytes(32)
} while (!(await secp256k1.privateKeyVerify(privateKey)));
const publicKey = await secp256k1.publicKeyCreate(privateKey);
const message = randomBytes(32);
// Custom nonce function is not supported yet for async.
const signOptions = {
// 32 bytes of custom data.
data: null
}
const signResult = await secp256k1.sign(message, privateKey, signOptions);
const verifyResult = await secp256k1.verify(message, signResult.signature, publicKey);
console.log(verifyResult);
})();
This project is kindly supported by:
I'd like to give special thanks to Viktor Simkó and Tibor Balla for helping me out when I was lost :unicorn:
signun is licensed under Apache-2.0.
Licenses of dependencies:
FAQs
N-API Crypto bindings.
The npm package @nlv8/signun receives a total of 0 weekly downloads. As such, @nlv8/signun popularity was classified as not popular.
We found that @nlv8/signun demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.