bip39 - npm Package Compare versions

Comparing version 2.3.0 to 2.3.1

index.js

@@ -0,1 +1,2 @@
+var Buffer = require('safe-buffer').Buffer
 var createHash = require('create-hash')
@@ -15,2 +16,29 @@ var pbkdf2 = require('pbkdf2').pbkdf2Sync
 
+var INVALID_MNEMONIC = 'Invalid mnemonic'
+var INVALID_ENTROPY = 'Invalid entropy'
+var INVALID_CHECKSUM = 'Invalid mnemonic checksum'
+
+function lpad (str, padString, length) {
+  while (str.length < length) str = padString + str
+  return str
+}
+
+function binaryToByte (bin) {
+  return parseInt(bin, 2)
+}
+
+function bytesToBinary (bytes) {
+  return bytes.map(function (x) {
+    return lpad(x.toString(2), '0', 8)
+  }).join('')
+}
+
+function deriveChecksumBits (entropyBuffer) {
+  var ENT = entropyBuffer.length * 8
+  var CS = ENT / 32
+  var hash = createHash('sha256').update(entropyBuffer).digest()
+
+  return bytesToBinary([].slice.call(hash)).slice(0, CS)
+}
+
 function salt (password) {
@@ -21,4 +49,4 @@ return 'mnemonic' + (password || '')
 function mnemonicToSeed (mnemonic, password) {
-  var mnemonicBuffer = new Buffer(unorm.nfkd(mnemonic), 'utf8')
-  var saltBuffer = new Buffer(salt(unorm.nfkd(password)), 'utf8')
+  var mnemonicBuffer = Buffer.from(unorm.nfkd(mnemonic), 'utf8')
+  var saltBuffer = Buffer.from(salt(unorm.nfkd(password)), 'utf8')
 
@@ -36,6 +64,3 @@ return pbkdf2(mnemonicBuffer, saltBuffer, 2048, 64, 'sha512')
   var words = unorm.nfkd(mnemonic).split(' ')
-  if (words.length % 3 !== 0) throw new Error('Invalid mnemonic')
-  if (words.some(function (word) {
-    return wordlist.indexOf(word) === -1
-  })) throw new Error('Invalid mnemonic')
+  if (words.length % 3 !== 0) throw new Error(INVALID_MNEMONIC)
 
@@ -45,2 +70,4 @@ // convert word indices to 11 bit binary strings
     var index = wordlist.indexOf(word)
+    if (index === -1) throw new Error(INVALID_MNEMONIC)
+
     return lpad(index.toString(2), '0', 11)
@@ -51,40 +78,36 @@ }).join('')
   var dividerIndex = Math.floor(bits.length / 33) * 32
-  var entropy = bits.slice(0, dividerIndex)
-  var checksum = bits.slice(dividerIndex)
+  var entropyBits = bits.slice(0, dividerIndex)
+  var checksumBits = bits.slice(dividerIndex)
 
   // calculate the checksum and compare
-  var entropyBytes = entropy.match(/(.{1,8})/g).map(function (bin) {
-    return parseInt(bin, 2)
-  })
-  var entropyBuffer = new Buffer(entropyBytes)
-  var newChecksum = checksumBits(entropyBuffer)
+  var entropyBytes = entropyBits.match(/(.{1,8})/g).map(binaryToByte)
+  if (entropyBytes.length < 16) throw new Error(INVALID_ENTROPY)
+  if (entropyBytes.length > 32) throw new Error(INVALID_ENTROPY)
+  if (entropyBytes.length % 4 !== 0) throw new Error(INVALID_ENTROPY)
 
-  // recreate properly chunked and padded bits to get the properly padded checksum
-  var bits2 = (entropy + newChecksum).match(/(.{1,11})/g).map(function (index) {
-    return lpad(index, '0', 11)
-  }).join('')
+  var entropy = Buffer.from(entropyBytes)
+  var newChecksum = deriveChecksumBits(entropy)
+  if (newChecksum !== checksumBits) throw new Error(INVALID_CHECKSUM)
 
-  var dividerIndex2 = Math.floor(bits2.length / 33) * 32
-  var newChecksum2 = bits2.slice(dividerIndex2)
-
-  if (newChecksum2 !== checksum) {
-    throw new Error('Invalid mnemonic checksum')
-  }
-
-  return entropyBuffer.toString('hex')
+  return entropy.toString('hex')
 }
 
-function entropyToMnemonic (entropy, wordlist) {
+function entropyToMnemonic (entropyHex, wordlist) {
   wordlist = wordlist || DEFAULT_WORDLIST
 
-  var entropyBuffer = new Buffer(entropy, 'hex')
-  var entropyBits = bytesToBinary([].slice.call(entropyBuffer))
-  var checksum = checksumBits(entropyBuffer)
+  // 128 <= ENT <= 256
+  if (entropyHex.length < 32) throw new TypeError(INVALID_ENTROPY)
+  if (entropyHex.length > 64) throw new TypeError(INVALID_ENTROPY)
 
-  var bits = entropyBits + checksum
+  // multiple of 4
+  if (entropyHex.length % 8 !== 0) throw new TypeError(INVALID_ENTROPY)
+
+  var entropy = Buffer.from(entropyHex, 'hex')
+  var entropyBits = bytesToBinary([].slice.call(entropy))
+  var checksumBits = deriveChecksumBits(entropy)
+
+  var bits = entropyBits + checksumBits
   var chunks = bits.match(/(.{1,11})/g)
-
   var words = chunks.map(function (binary) {
-    var index = parseInt(binary, 2)
-
+    var index = binaryToByte(binary)
     return wordlist[index]
@@ -98,2 +121,3 @@ })
   strength = strength || 128
+  if (strength % 32 !== 0) throw new TypeError(INVALID_ENTROPY)
   rng = rng || randomBytes
@@ -115,25 +139,2 @@
 
-function checksumBits (entropyBuffer) {
-  var hash = createHash('sha256').update(entropyBuffer).digest()
-
-  // Calculated constants from BIP39
-  var ENT = entropyBuffer.length * 8
-  var CS = ENT / 32
-
-  return bytesToBinary([].slice.call(hash)).slice(0, CS)
-}
-
-// =========== helper methods from bitcoinjs-lib ========
-
-function bytesToBinary (bytes) {
-  return bytes.map(function (x) {
-    return lpad(x.toString(2), '0', 8)
-  }).join('')
-}
-
-function lpad (str, padString, length) {
-  while (str.length < length) str = padString + str
-  return str
-}
-
 module.exports = {
@@ -140,0 +141,0 @@ mnemonicToSeed: mnemonicToSeed,

package.json

 {
   "name": "bip39",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Bitcoin BIP39: Mnemonic code for generating deterministic keys",
@@ -30,2 +30,3 @@ "main": "index.js",
     "randombytes": "^2.0.1",
+    "safe-buffer": "^5.0.1",
     "unorm": "^1.3.3"
@@ -37,5 +38,5 @@ },
     "proxyquire": "^1.7.10",
-    "standard": "*",
+    "standard": "^10.0.2",
     "tape": "^4.6.2"
   }
 }

README.md

@@ -45,4 +45,4 @@ # BIP39
 // uses HEX strings for entropy
-var mnemonic = bip39.entropyToMnemonic('133755ff')
-// => basket rival lemon
+var mnemonic = bip39.entropyToMnemonic('00000000000000000000000000000000')
+// => zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong
 
@@ -49,0 +49,0 @@ // reversible

test/index.js

 var bip39 = require('../')
-var proxyquire = require('proxyquire')
+var Buffer = require('safe-buffer').Buffer
 var download = require('../util/wordlists').download
@@ -18,3 +18,3 @@ var WORDLISTS = {
 
-  test('for ' + description + ' test vector ' + i, function (t) {
+  test('for ' + description + '(' + i + '), ' + ventropy, function (t) {
     t.plan(5)
@@ -24,6 +24,5 @@
     t.equal(bip39.mnemonicToSeedHex(vmnemonic, password), vseedHex, 'mnemonicToSeedHex returns ' + vseedHex.slice(0, 40) + '...')
-
     t.equal(bip39.entropyToMnemonic(ventropy, wordlist), vmnemonic, 'entropyToMnemonic returns ' + vmnemonic.slice(0, 40) + '...')
 
-    function rng () { return new Buffer(ventropy, 'hex') }
+    function rng () { return Buffer.from(ventropy, 'hex') }
     t.equal(bip39.generateMnemonic(undefined, rng, wordlist), vmnemonic, 'generateMnemonic returns RNG entropy unmodified')
@@ -38,2 +37,18 @@ t.equal(bip39.validateMnemonic(vmnemonic, wordlist), true, 'validateMnemonic returns true')
 
+test('invalid entropy', function (t) {
+  t.plan(3)
+
+  t.throws(function () {
+    bip39.entropyToMnemonic(Buffer.from('', 'hex'))
+  }, /^TypeError: Invalid entropy$/, 'throws for empty entropy')
+
+  t.throws(function () {
+    bip39.entropyToMnemonic(Buffer.from('000000', 'hex'))
+  }, /^TypeError: Invalid entropy$/, 'throws for entropy that\'s not a multitude of 4 bytes')
+
+  t.throws(function () {
+    bip39.entropyToMnemonic(Buffer.from(new Array(1028 + 1).join('00'), 'hex'))
+  }, /^TypeError: Invalid entropy$/, 'throws for entropy that is larger than 1024')
+})
+
 test('UTF8 passwords', function (t) {
@@ -54,54 +69,15 @@ t.plan(vectors.japanese.length * 2)
 
-test('README example 1', function (t) {
-  // defaults to BIP39 English word list
-  var entropy = '133755ff'
-  var mnemonic = bip39.entropyToMnemonic(entropy)
-
-  t.plan(2)
-  t.equal(mnemonic, 'basket rival lemon')
-
-  // reversible
-  t.equal(bip39.mnemonicToEntropy(mnemonic), entropy)
-})
-
-test('README example 2', function (t) {
-  var stub = {
-    randombytes: function (size) {
-      return new Buffer('qwertyuiopasdfghjklzxcvbnm[];,./'.slice(0, size))
-    }
-  }
-  var proxiedbip39 = proxyquire('../', stub)
-
-  // mnemonic strength defaults to 128 bits
-  var mnemonic = proxiedbip39.generateMnemonic()
-
-  t.plan(2)
-  t.equal(mnemonic, 'imitate robot frame trophy nuclear regret saddle around inflict case oil spice')
-  t.equal(bip39.validateMnemonic(mnemonic), true)
-})
-
-test('README example 3', function (t) {
-  var mnemonic = 'basket actual'
-  var seed = bip39.mnemonicToSeed(mnemonic)
-  var seedHex = bip39.mnemonicToSeedHex(mnemonic)
-
-  t.plan(3)
-  t.equal(seed.toString('hex'), seedHex)
-  t.equal(seedHex, '5cf2d4a8b0355e90295bdfc565a022a409af063d5365bb57bf74d9528f494bfa4400f53d8349b80fdae44082d7f9541e1dba2b003bcfec9d0d53781ca676651f')
-  t.equal(bip39.validateMnemonic(mnemonic), false)
-})
-
 test('generateMnemonic can vary entropy length', function (t) {
-  var words = bip39.generateMnemonic(96).split(' ')
+  var words = bip39.generateMnemonic(160).split(' ')
 
   t.plan(1)
-  t.equal(words.length, 9, 'can vary generated entropy bit length')
+  t.equal(words.length, 15, 'can vary generated entropy bit length')
 })
 
-test('generateMnemonic only requests the exact amount of data from an RNG', function (t) {
+test('generateMnemonic requests the exact amount of data from an RNG', function (t) {
   t.plan(1)
 
-  bip39.generateMnemonic(96, function (size) {
-    t.equal(size, 96 / 8)
-    return new Buffer(size)
+  bip39.generateMnemonic(160, function (size) {
+    t.equal(size, 160 / 8)
+    return Buffer.allocUnsafe(size)
   })
@@ -111,6 +87,7 @@ })
 test('validateMnemonic', function (t) {
-  t.plan(4)
+  t.plan(5)
 
   t.equal(bip39.validateMnemonic('sleep kitten'), false, 'fails for a mnemonic that is too short')
   t.equal(bip39.validateMnemonic('sleep kitten sleep kitten sleep kitten'), false, 'fails for a mnemonic that is too short')
+  t.equal(bip39.validateMnemonic('abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about end grace oxygen maze bright face loan ticket trial leg cruel lizard bread worry reject journey perfect chef section caught neither install industry'), false, 'fails for a mnemonic that is too long')
   t.equal(bip39.validateMnemonic('turtle front uncle idea crush write shrug there lottery flower risky shell'), false, 'fails if mnemonic words are not in the word list')
@@ -117,0 +94,0 @@ t.equal(bip39.validateMnemonic('sleep kitten sleep kitten sleep kitten sleep kitten sleep kitten sleep kitten'), false, 'fails for invalid checksum')

test/vectors.json

@@ -122,7 +122,2 @@ {
       "b15509eaa2d09d3efd3e006ef42151b30367dc6e3aa5e44caba3fe4d3e352e65101fbdb86a96776b91946ff06f8eac594dc6ee1d3e82a42dfe1b40fef6bcc3fd"
-    ],
-    [
-      "00000000009a54180ac35938181b318ea3ee09c1cb35d552d5d0d2304808eb820bdb562a729283a2b0a35d46d10a39bec48d151f194c48ea2b257db81e82410943874cc1267ae2495122f1705dac461db0f0bc9a0bde6bc8a4e8e3a2b86aa1550c428e81ec7990a1c27c806bc9ed48b7bd7c7535b16cd2fdf3ee8f05d7b9da2fb61efb17f360de3253b69813ea3a5442e065e50a013372f9b628976bcdc8909600634520de93ed34ec8cefd2f9bd21e8922be4a6e1f609a00ace8aef88ab727f85988dae8c5f5a1a64f121f6baa6d117af31edca97a7743c0581753632faab42ff4b9c800024e390c7f8f72e566e333a2e69344f4f7c5d0ac63b2c0bf1aa48f12dc3ea395b2bb38841e14912fcb75192519c25a4913943ca435d73fcd3a74187884524194a4a025a1f3876582c67af84dc05b8fea262028ae049e53f724f9614fd01b66e501936b735c384fb462ea5d490eb0b189173e43a9d0a1c0b5ed06d7e989e5e888e9fa7377a96d55ba67b4d2bcabffb48c467133bd62c7ccdd3bd2a1eac39c2237b98591b598804b2701882fdd800c767a4189b4e92c981a7782df30b2f50beab4b17a0c95451533ff0175792f05fb09c393604453166b277aba0aefe611ebfb0eccf686469b5490933ee75c35555c9ef271993d869282217d62452ad9b078f0f9fdd6725983e4da5280fa9052b2c6648cbd4583ca05d69d1996704953452a3c66ceb9680ecbc3164ca2c8a7d4dbb1852ca22fa4bbda7b97d56b698da2e66e3c8af5fdde3f58dcc10a89570a70e63d0784a842112231e118a767765e140f91001cab2688a97fdfbd2ba620f743813adf8fade4ef625ed410b89d7239a28d78fa1c10fce957f69dd1e81af0d255658e016f5fc943b040f31c17876ea178e6a0758a8b8d389ed76320a41e631fa1deea3cb7bebb6df1593826c9ee8efb094e2397ff8fe73f73c4d1e710144152fe7ba208b3d79f2b221f335d04742a0c7cfad6a1f1deaeef4b6f5cea41b0283f42883fed4e259dccc4d05ffabac26a6d886cc1318aac98e56cedbcf1f047d8789f7e38295a4a7d8c17683c72cedd393eadd498e097f10947a2a38a131d16cc3489274482b47ec4f06eea019d1920cafd49350c767c5901da6ffafb73817d8cc70daf0e286bbbffacd84433fd4d15fb477397bb65e7b785b0a0ca4516540b2c920a4bcade486556f124d3bdac6c2c3bf32eaa5f2699f42194b7be6a1632f7f7b4c7d684dbd6193e3aabbb23be0dc47c10dd306f9bed063efc12e376d4d959e70811e44074bd972f8db8f2c58f9313db6d18b6d38f1318235fb2c864ae10cad3ceb55edc3e861a8aac755505d433362ee428d788e427bd6595abc8f4201a84d1f13d6443df4206871884b1aac83f0637bd6b9242d210297d32572c8a6d97fcf21530cfd5eddd36d6d0b333e3f056fa04ddba500ddd2",
-      "abandon abandon abandon abuse pipe army climb hen day school small bubble discover agent already grit stem note injury piece afraid afford puppy door swap rally original celery demand flame miracle potato speed fade hurry math spend moon gown math tuition float garage ice trial calm celery ill error ankle pact setup never multiply shift arm proof couch history thumb situate album keen jungle pilot either trim ignore present pride country fade limit glow goddess drum chief dizzy quality diet emerge sadness gallery tuna force reopen episode salmon update join invest inhale pepper swallow know glass vibrant alone milk polar hat antique pottery enhance drill add junk beef basket ride traffic shallow number fury impulse cancel gas coyote behind bridge negative have depth border wood lamp virus dial mutual game claim sentence gauge source clinic spend usage earn symptom yellow flower egg riot message foam spring detail dumb hill fat dust vote cradle hour planet exclude duck actress alarm plug cream stem spawn write right divorce above organ move divert differ frequent group book trim snake crowd kidney tenant ring property budget rabbit lawsuit prevent elegant enter march phone pulse put illegal draft apart dwarf west insect since edit lucky pig mean extend nest cupboard rigid viable insane dose detail bacon else net celery annual dumb debris ready arch soon weapon host black cabin pen avoid pencil scene oxygen panic since version belt trend horn syrup account opera system reveal lumber surface merry entry empower intact cluster banana initial canyon point before scheme quarter double quit obtain very peasant brush whip option tumble survey forum critic spy fiscal program world cart mind basket team mention wet tag teach position stereo degree baby ten cost museum proud cactus north hybrid series satoshi quote arrest record motor beach excess north gather exclude lizard wet coach tube salt fog shine dose next chunk erupt wrap blanket route rose satoshi antenna broken submit master cousin culture over firm april left love subject rail grid sure silver opera pig cave lava into boy fever need venue mimic exhaust artwork choice awful void emerge client snow bullet tiger panther twenty siren corn tooth spoon parent vivid ahead floor book muscle run clown verb arm hawk mimic flush ankle fashion citizen monitor snow twist reduce depth journey bind govern rate exile ethics sugar believe nephew cook chair walk warm later remember plate reform toy impose cargo typical target cabbage gloom oblige appear enjoy secret tide glow long bargain analyst bachelor bag joke course island robot joke limit much abstract client escape melody say leave pistol plate amateur special act pupil sick resource over girl wall aerobic illness strong broom mechanic pyramid wheel they dish sport legal exclude element addict valid naive floor bright black quiz celery invite domain ocean album attract tube round once attitude melody fragile evolve diet involve motion motor small cabbage auction ritual just know frozen result clinic deal curve knife bulb rack poem mixture zoo morning delay table meadow bunker marine extra clean wrist tackle lion guilt ketchup night mask toy fringe casual appear body soul hero march design puzzle kid swift right piano submit path tribe market youth fatal enroll system give door young river battle opinion awkward slot occur click narrow tornado guess hundred token afford umbrella tiny used deal enlist myth wild scrap reduce vault flush tag size problem powder mix episode service cigar pencil brisk luggage demand holiday bottom cause trigger live physical raise this upgrade absorb inner catch slab tumble essence body guitar clutch alter evil wife swear theory wild small man rotate shallow hill that twenty rack drip wrong crowd satoshi electric original uphold slim kiwi security secret bone eagle razor actress float camera chalk clock simple grab resource empty polar suspect current rail lazy concert fancy situate crop dragon ski ten snap bike nut worth hat latin draw hungry segment dilemma stem uphold electric this timber utility brick corn lamp win arrest used annual miss surround sun song search cat dune demise wagon tourist misery shy ramp busy couple unit refuse bitter squeeze joy ship effort will goddess naive search skull oyster pull sad sentence drink health few inspire popular insect grid glass improve person valve tomorrow digital floor clip route key lesson explain spin measure flip marble vintage addict broccoli awesome random film average arrest knock remind empower fog awake episode erode purity silly cycle garment oxygen benefit major voice sweet square hidden drift grid token live salon answer sweet chimney danger pizza magic deny clean forum garbage alter price seed hero visit where grain version oval clutch among welcome struggle first entire cheese trend issue",
-      "c8143da36c01b19ddba54c4d3127cc1769f1ae7d3e785126b4e4970bba4c30f1248ded216e6d45261e8e637bd2c76b71b14e602c8601c7b85e5648724449f8a7"
     ]
@@ -129,0 +124,0 @@ ],

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

203173

increased by0.11%

Number of package files

16

increased by6.67%

Lines of code

12866

increased by0.09%

Number of medium supply chain risk alerts

1

decreased by-66.67%

Worsened metrics

Dependency count

5

increased by25%

Number of low supply chain risk alerts

2

increased by100%

Dependency changes

• + Addedsafe-buffer@^5.0.1