
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
The base32 npm package provides utilities for encoding and decoding data using the Base32 encoding scheme. This encoding is often used in applications where data integrity is crucial, such as in QR codes, OTP (One-Time Password) generation, and data storage.
Encoding
This feature allows you to encode a string into Base32 format. The example encodes the string 'Hello, World!' into its Base32 representation.
const base32 = require('base32');
const encoded = base32.encode('Hello, World!');
console.log(encoded); // Outputs: 'JBSWY3DPEBLW64TMMQ======'
Decoding
This feature allows you to decode a Base32 encoded string back to its original form. The example decodes the Base32 string 'JBSWY3DPEBLW64TMMQ======' back to 'Hello, World!'.
const base32 = require('base32');
const decoded = base32.decode('JBSWY3DPEBLW64TMMQ======');
console.log(decoded); // Outputs: 'Hello, World!'
The base32.js package provides similar functionality for encoding and decoding Base32 strings. It offers a more comprehensive API and supports different variants of Base32 encoding, making it more versatile for various use cases.
The thirty-two package is another alternative for Base32 encoding and decoding. It is lightweight and easy to use, similar to base32, but it also includes additional features like support for RFC 4648 Base32 encoding.
The otplib package is primarily used for generating and verifying OTPs (One-Time Passwords) but includes Base32 encoding and decoding as part of its feature set. It is a good choice if you need both OTP functionality and Base32 encoding/decoding in one package.
Base 32 is between hexadecimal notation and Base 64 encoding. It's intended to be a human-friendly -- you don't have to worry about punctuation, capitalization, or letters/numbers that are easy to confuse, making it easier to transmit in handwriting or over the phone.
One of the primary purposes is to have aesthetically pleasing SHA1 hashes. Compare:
17O57684bea1f9331418b633a8f373119d765fd4
xE_ptB5SeclHm8JEsD0-ST1mTBM
2w2qd15ym7wk650rprtuh4vk26eqcqym
Try giving out the Base 64 hash over the phone! "lowercase 'x', capital 'E', underscore, lowercase 'p', ..." Base 32 will work the same with upper- or lowercase, you can mistake a number for a similar-looking letter, and it will still decode to the same data.
In your shell, install with npm:
npm install base32
In your code:
var base32 = require('base32')
// simple api
var encoded = base32.encode('some data to encode')
var decoded = base32.decode(encoded)
// streaming api
this.encoder = new Base32.encoder()
this.dataCallback = function(chunk) {
this.emit(this.encoder(chunk))
}
this.closeCallback = function(chunk) {
this.emit(this.finish()) // flush any remaining bits
}
// easy sha1 hash
var hash = base32.sha1(some_data_to_hash) // DONE.
On the command-line (to install system-wide, use npm install -g base32
):
base32 -h
#> Usage: base32 [input_file] [-o output_file] [-d|--decode] [-s|--sha]
echo "Hello World" | base32
#> 91jprv3f41bpywkccg50
echo 'axqqeb10d5u20wk5c5p6ry90exqq4uvk44' | base32 -d
#> Wow, it really works!
base32 -s test/*
#> ky2t1raumjn9cghne773petngx3zz3q7 test/base32-test.coffee
#> 6b4bkjaveddmg5jh7hnyw132yht20g6e test/compare.coffee
There are about (128 choose 32) different specifications of something called "Base 32" - see Wikipedia for some of them.
This is just one that should be simple, less error-prone, and streamable (for Node).
The encoding alphabet consists of the numerals 0-9 and the letters a-z, excluding a few letters that might look like numbers, which we simply interpret as follows:
When decoding, capital letters are converted to lowercase and the "ambiguous" letters mentioned above converted to their numeric counterparts.
Each character corresponds to 5 bits of input.
Lexicographic order of strings is preserved through Base 32 encoding.
Under MIT License.
Fork as much as you like, I'm more than amenable to pull requests. I'm trying to keep it reasonably node-ish, so bear that in mind.
FAQs
Base32 encoding and decoding
The npm package base32 receives a total of 171,028 weekly downloads. As such, base32 popularity was classified as popular.
We found that base32 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.