Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A pure JavaScript implementation of large-integer math, capable of performing useful-sized (512-bit, 1024-bit) RSA encryption. Packaged to also be used in a node environment.
This library is a packaging of the original code from Tom Wu. The original files are available in the original/ folder or on his site.
If you are using npm (the node packet manager), installing is as easy as: npm install bignumber
For help on using this in node.js, have a look at the tests. Here is a simple example on how to generate a new key and use it to encrypt/decrypt a message.
var rsa = require("bigint");
var key = new rsa.Key();
var message = "All your bases are belong to us.";
console.log("Message:\n"+message+"\n");
// Generate a key
key.generate(1024, "10001");
console.log("Key:\n");
console.log("n:" + key.n.toString(16));
console.log("e:" + key.e.toString(16));
console.log("d:" + key.d.toString(16));
console.log("\n");
// Encrypt
var encrypted = key.encrypt(message);
console.log("Encrypted:\n" + rsa.linebrk(encrypted, 64) + "\n" );
// Decrypt
var decrypted = key.decrypt(encrypted);
console.log("Decrypted:" + rsa.linebrk(decrypted, 64) + "\n");
The original documentation is available at http://www-cs-students.stanford.edu/~tjw/jsbn/.
Copyright (c) 2003-2005 Tom Wu All Rights Reserved.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
In addition, the following condition applies:
All redistributions must retain an intact copy of this copyright notice and disclaimer.
FAQs
A pure javascript implementation of BigIntegers and RSA crypto.
The npm package bignumber receives a total of 11,021 weekly downloads. As such, bignumber popularity was classified as popular.
We found that bignumber demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.