
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
argon2-native
Advanced tools
This is a fork of ranisalt/node-argon2 using node 24's crypto.argon2() instead of libargon2.
node-argon2import argon2 instead of import * as argon2version so this is not configurable.
needsRehash will always return true if a version is specified in the digest.options.type is now a string instead of an enum:hash('password', {
- type: argon2.argon2d
+ type: 'argon2d'
})
It's possible to hash using either Argon2i, Argon2d or Argon2id (default), and verify if a password matches a hash.
To hash a password:
import argon2 from 'argon2-native'
try {
const hash = await argon2.hash('password')
} catch (err) {
//...
}
To see how you can modify the output (hash length, encoding) and parameters (time cost, memory cost and parallelism), read the wiki
To verify a password:
try {
if (await argon2.verify('<big long hash>', 'password')) {
// password match
} else {
// password did not match
}
} catch (err) {
// internal failure
}
See this article on the wiki for steps on how to migrate your existing code to Argon2. It's easy!
A TypeScript type declaration file is published with this module. If you are using TypeScript 2.0.0 or later, that means you do not need to install any additional typings in order to get access to the strongly typed interface. Simply use the library as mentioned above.
import argon2 from 'argon2-native'
const hash = await argon2.hash(...)
This project exists thanks to all the people who contribute. [Contribute].
Become a financial contributor and help us sustain our community. [Contribute]
Support this project with your organization. Your logo will show up here with a link to your website. [Contribute]
Work licensed under the MIT License.
FAQs
An Argon2 library for Node
We found that argon2-native demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.