@scure/bip32 - npm Package Compare versions

Comparing version 1.0.1 to 1.1.0

package.json

 {
   "name": "@scure/bip32",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Secure, audited & minimal implementation of BIP32 hierarchical deterministic (HD) wallets",
-  "main": "index.js",
+
   "files": [
-    "index.js",
-    "index.d.ts"
+    "lib/index.js",
+    "lib/esm/index.js",
+    "lib/index.d.ts",
+    "lib/esm/package.json"
   ],
-  "types": "index.d.ts",
+  "main": "lib/index.js",
+  "module": "lib/esm/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./lib/esm/index.js",
+      "default": "./lib/index.js"
+    },
+    "./index.d.ts": "./lib/index.d.ts"
+  },
   "dependencies": {
-    "@noble/hashes": "~1.0.0",
-    "@noble/secp256k1": "~1.5.2",
-    "@scure/base": "~1.0.0"
+    "@noble/hashes": "~1.1.1",
+    "@noble/secp256k1": "~1.6.0",
+    "@scure/base": "~1.1.0"
   },
@@ -19,4 +30,4 @@ "devDependencies": {
     "mocha": "9.2.0",
-    "prettier": "2.4.1",
-    "typescript": "4.5.4"
+    "prettier": "2.6.2",
+    "typescript": "4.7.3"
   },
@@ -41,3 +52,3 @@ "author": "Paul Miller (https://paulmillr.com)",
   "scripts": {
-    "build": "tsc",
+    "build": "tsc -d && tsc -p tsconfig.esm.json",
     "lint": "prettier --check 'index.ts' 'test/**/*.{js,ts}'",
@@ -44,0 +55,0 @@ "format": "prettier --write 'index.ts' 'test/**/*.{js,ts}'",

README.md

 # scure-bip32
 
-Secure, audited & minimal implementation of BIP32 hierarchical deterministic (HD) wallets.
+Secure, [audited](#security) & minimal implementation of BIP32 hierarchical deterministic (HD) wallets.
 
-Developed for
-[js-ethereum-cryptography](https://github.com/ethereum/js-ethereum-cryptography).
+Compared to popular `hdkey` package, scure-bip32:
+
+- Is 418KB all-bundled instead of 5.9MB
+- Uses 3 dependencies instead of 24
+- Had an external security [audit](#security) by Cure53 on Jan 5, 2022
+
 Check out [scure-bip39](https://github.com/paulmillr/scure-bip39) if you need mnemonic phrases.
 
-The library has been audited by Cure53 on Jan 5, 2022. Check out the audit [PDF](./audit/2022-01-05-cure53-audit-nbl2.pdf) & [URL](https://cure53.de/pentest-report_hashing-libs.pdf). Before the audit it was called `micro-bip32`.
-
 ### This library belongs to *scure*
@@ -30,4 +32,2 @@
 
-## API
-
 This module exports a single class `HDKey`, which should be used like this:
@@ -97,2 +97,11 @@
 
+## Security
+
+The library has been audited by Cure53 on Jan 5, 2022. Check out the audit [PDF](./audit/2022-01-05-cure53-audit-nbl2.pdf) & [URL](https://cure53.de/pentest-report_hashing-libs.pdf).
+
+1. The library was initially developed for [js-ethereum-cryptography](https://github.com/ethereum/js-ethereum-cryptography)
+2. At commit [ae00e6d7](https://github.com/ethereum/js-ethereum-cryptography/commit/ae00e6d7d24fb3c76a1c7fe10039f6ecd120b77e), it
+  was extracted to a separate package called `micro-bip32`
+3. After the audit we've decided to use NPM namespace for security. Since `@micro` namespace was taken, we've renamed the package to `@scure/bip32`
+
 ## License
@@ -99,0 +108,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

26541

increased by46.64%

Number of package files

7

increased by40%

Lines of code

571

increased by67.45%

Number of lines in readme file

110

increased by8.91%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• + Added@noble/hashes@1.1.5(transitive)

• + Added@noble/secp256k1@1.6.3(transitive)

• + Added@scure/base@1.1.9(transitive)

• - Removed@noble/hashes@1.0.0(transitive)

• - Removed@noble/secp256k1@1.5.5(transitive)

• - Removed@scure/base@1.0.0(transitive)

• Updated@noble/hashes@~1.1.1

• Updated@noble/secp256k1@~1.6.0

• Updated@scure/base@~1.1.0