@turnkey/crypto - npm Package Compare versions

Comparing version 2.4.0 to 2.4.1

CHANGELOG.md

 # @turnkey/crypto
 
+## 2.4.1
+
+### Patch Changes
+
+- [#700](https://github.com/tkhq/sdk/pull/700) [`878e039`](https://github.com/tkhq/sdk/commit/878e03973856cfec83e6e3fda5b76d1b64943628) Author [@andrewkmin](https://github.com/andrewkmin) - Add validations to uncompressRawPublicKey method
+
 ## 2.4.0
@@ -4,0 +10,0 @@

dist/crypto.js

@@ -240,2 +240,8 @@ 'use strict';
 const uncompressRawPublicKey = (rawPublicKey) => {
+    if (rawPublicKey.length !== 33) {
+        throw new Error("failed to uncompress raw public key: invalid length");
+    }
+    if (!(rawPublicKey[0] === 2 || rawPublicKey[0] === 3)) {
+        throw new Error("failed to uncompress raw public key: invalid prefix");
+    }
     // point[0] must be 2 (false) or 3 (true).
@@ -242,0 +248,0 @@ // this maps to the initial "02" or "03" prefix

dist/crypto.mjs

@@ -219,2 +219,8 @@ import { p256 } from '@noble/curves/p256';
 const uncompressRawPublicKey = (rawPublicKey) => {
+    if (rawPublicKey.length !== 33) {
+        throw new Error("failed to uncompress raw public key: invalid length");
+    }
+    if (!(rawPublicKey[0] === 2 || rawPublicKey[0] === 3)) {
+        throw new Error("failed to uncompress raw public key: invalid prefix");
+    }
     // point[0] must be 2 (false) or 3 (true).
@@ -221,0 +227,0 @@ // this maps to the initial "02" or "03" prefix

package.json

 {
   "name": "@turnkey/crypto",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "main": "./dist/index.js",
@@ -38,6 +38,6 @@ "module": "./dist/index.mjs",
   "dependencies": {
-    "@noble/ciphers": "0.5.3",
-    "@noble/curves": "1.4.0",
-    "@noble/hashes": "1.4.0",
-    "bs58check": "3.0.1",
+    "@noble/ciphers": "1.3.0",
+    "@noble/curves": "1.9.0",
+    "@noble/hashes": "1.8.0",
+    "bs58check": "4.0.0",
     "bs58": "6.0.0"
@@ -47,5 +47,5 @@ },
     "jest": "29.7.0",
-    "@turnkey/http": "3.4.1",
-    "@turnkey/api-key-stamper": "0.4.6",
-    "@turnkey/encoding": "0.5.0"
+    "@turnkey/encoding": "0.5.0",
+    "@turnkey/api-key-stamper": "0.4.7",
+    "@turnkey/http": "3.5.0"
   },
@@ -52,0 +52,0 @@ "scripts": {

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

167048

0.79%

Lines of code

1937

0.62%

Worsened metrics

Number of medium supply chain risk alerts

1

Infinity%

Dependency changes

• + Added

  @noble/ciphers@1.3.0
  (transitive)

• + Added

  @noble/curves@1.9.0
  (transitive)

• + Added

  @noble/hashes@1.8.0
  (transitive)

• + Added

  bs58check@4.0.0
  (transitive)

• - Removed

  @noble/ciphers@0.5.3
  (transitive)

• - Removed

  @noble/curves@1.4.0
  (transitive)

• - Removed

  @noble/hashes@1.4.0
  (transitive)

• - Removed

  base-x@4.0.1
  (transitive)

• - Removed

  bs58@5.0.0
  (transitive)

• - Removed

  bs58check@3.0.1
  (transitive)

• Updated

  @noble/ciphers@1.3.0

• Updated

  @noble/curves@1.9.0

• Updated

  @noble/hashes@1.8.0

• Updated

  bs58check@4.0.0