Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@zxcvbn-ts/language-common
Advanced tools
@zxcvbn-ts/language-common is a TypeScript library that provides common language data for the zxcvbn-ts password strength estimator. It includes dictionaries and scoring functions to help evaluate password strength based on common patterns, words, and sequences.
Common Words Dictionary
This feature provides a dictionary of common words that are used to evaluate the strength of a password. The dictionary helps in identifying weak passwords that contain easily guessable words.
const commonWords = require('@zxcvbn-ts/language-common').dictionary.commonWords;
console.log(commonWords);
L33t Speak Dictionary
This feature includes a dictionary for l33t speak (leet speak) transformations. It helps in identifying passwords that use common character substitutions, such as '3' for 'E' or '1' for 'I'.
const l33tTable = require('@zxcvbn-ts/language-common').dictionary.l33tTable;
console.log(l33tTable);
Scoring Functions
This feature provides scoring functions to evaluate the strength of a password based on the most guessable match sequence. It helps in determining how easily a password can be guessed.
const scoring = require('@zxcvbn-ts/language-common').scoring;
const score = scoring.mostGuessableMatchSequence('password123', []);
console.log(score);
zxcvbn is a password strength estimator inspired by password crackers. It is a comprehensive library that evaluates password strength based on common patterns, words, and sequences. Compared to @zxcvbn-ts/language-common, zxcvbn is a more complete solution that includes both the language data and the estimation logic.
owasp-password-strength-test is a library that provides password strength testing based on the OWASP guidelines. It includes checks for common patterns, dictionary words, and character sequences. While it offers similar functionality to @zxcvbn-ts/language-common, it is more focused on adhering to OWASP standards.
password-validator is a simple library for validating passwords against a set of rules. It allows you to define custom rules for password strength, such as minimum length, required character types, and forbidden words. Unlike @zxcvbn-ts/language-common, it does not provide dictionaries or scoring functions but offers flexibility in defining password policies.
The common dictionary and language package for zxcvbn-ts
npm install @zxcvbn-ts/language-common --save
yarn add @zxcvbn-ts/language-common
import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core'
import * as zxcvbnCommonPackage from '@zxcvbn-ts/language-common'
const password = 'somePassword'
const options = {
...zxcvbnCommonPackage,
}
zxcvbnOptions.setOptions(options)
zxcvbn(password)
FAQs
The common language package for zxcvbn-ts
The npm package @zxcvbn-ts/language-common receives a total of 81,371 weekly downloads. As such, @zxcvbn-ts/language-common popularity was classified as popular.
We found that @zxcvbn-ts/language-common demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.