
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A comprehensive authentication package providing:
✅ OAuth authentication with Google, GitHub, Microsoft, and Okta.
✅ JWT token generation and verification.
✅ Secure password hashing.
✅ OTP (One-Time Password) functionality.
This package is designed to be easy to integrate into your application, providing flexible and secure user authentication.
| Feature | Description |
|---|---|
| 🔐 JWT Authentication | Securely sign and verify JSON Web Tokens. |
| 🔑 OAuth Authentication | Integrate authentication with Google, GitHub, Microsoft, and Okta. |
| 🔏 Password Hashing | Safely hash and validate user passwords using SHA-512. |
| 🔢 OTP Authentication | Generate and verify OTPs for added security. |
npm install auth-it
yarn add auth-it
To use the package, configure the following environment variables in your .env file.
# For Okta
OKTA_ISSUER=https://your-okta-domain.okta.com/oauth2/default
OKTA_CLIENT_ID=your-okta-client-id
OKTA_CLIENT_SECRET=your-okta-client-secret
OKTA_REDIRECT_URI=http://localhost:3000/callback
# For Microsoft
TENANT_ID=your-microsoft-tenant-id
# JWT Secret Key
JWT_SECRET_KEY=your-jwt-secret-key
Replace placeholder values with your actual credentials.
To use this package, import the required authentication service as shown below:
import { hashService } from 'auth-it';
// Create Salt
const salt = hashService.createSalt();
console.log(salt);
// Hash Password
const hashedPassword = hashService.hashPassword('userPassword', salt);
console.log(hashedPassword);
// Validate Password
const isValid = hashService.validatePassword('userPassword', salt, hashedPassword);
console.log(isValid); // true or false
// Generate JWT Token
const token = hashService.generateJwt({ userId: '123' });
console.log(token);
// Verify JWT Token
const decoded = hashService.verifyToken(token);
console.log(decoded);
import { oauthService } from 'auth-it';
// Get OAuth Authorization URL
const authUrl = oauthService.getAuthURL('google', {
clientId: 'your-client-id',
redirectUri: 'http://localhost:3000/callback',
scope: 'openid email profile',
});
console.log(authUrl);
// Get Access Token
const token = await oauthService.getToken('google', 'authorization-code', {
clientId: 'your-client-id',
clientSecret: 'your-client-secret',
redirectUri: 'http://localhost:3000/callback',
});
console.log(token);
// Get User Info
const userInfo = await oauthService.getUserInfo('google', token);
console.log(userInfo);
import { otpService } from 'auth-it';
// Send OTP via Email
const otp = await otpService.SendEmailtoOtp('user@example.com');
console.log(otp);
// Verify OTP
const isVerified = otpService.verifyOtp('user@example.com', '123456');
console.log(isVerified); // true or false
This package is licensed under the ISC License.
🚀 Now you're ready to integrate auth-it into your application!
Created by Kathan Adalaja 🚀
FAQs
A comprehensive authentication package providing:
We found that auth-it demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.