Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
create-ecdh
Advanced tools
The create-ecdh npm package is a library that provides an interface for creating Elliptic Curve Diffie-Hellman (ECDH) key pairs. It is used to securely exchange cryptographic keys over a public channel and is commonly used in the implementation of secure communication protocols.
Key Pair Generation
This feature allows the generation of ECDH key pairs, which can be used for secure key exchange.
const createECDH = require('create-ecdh');
const ecdh = createECDH('secp256k1');
ecdh.generateKeys();
Compute Shared Secret
Using this feature, one can compute a shared secret given the other party's public key, which can then be used to derive encryption keys for secure communication.
const theirPublicKey = Buffer.from('their public key hex', 'hex');
const sharedSecret = ecdh.computeSecret(theirPublicKey);
Get Public Key
This feature retrieves the public key of the generated ECDH key pair, which can be shared with the other party.
const publicKey = ecdh.getPublicKey();
Set Private Key
This feature sets the private key for the ECDH instance, which can be used to compute the shared secret or regenerate the public key.
const privateKey = Buffer.from('your private key hex', 'hex');
ecdh.setPrivateKey(privateKey);
Elliptic is a package that provides a general implementation of elliptic curve cryptography, including ECDH. It offers more comprehensive functionality for elliptic curve operations compared to create-ecdh.
Node-forge is a package that includes a wide range of cryptographic operations, including ECDH. It is more extensive than create-ecdh, as it covers other cryptographic mechanisms like RSA, MD5, SHA, and more.
Crypto is a built-in Node.js module that provides cryptographic functionality, including ECDH. It is directly integrated into Node.js and does not require additional installation, unlike create-ecdh.
In io.js or node >= 0.11 this module is just a shortcut to crypto.createECDH. In node <= 0.11 or the browser this is a pure JavaScript implimentation, more specifically a wrapper around elliptic, to give it the same API as node. secp256k1
, secp224r1
(aka p224), prime256v1
(aka p256, secp256r1), prime192v1
(aka p192, secp192r1), secp384r1
(aka p384), secp521r1
(aka p521) curves all work in both this library and node (though only the highlighted name will work in node).
FAQs
createECDH but browserifiable
The npm package create-ecdh receives a total of 6,822,980 weekly downloads. As such, create-ecdh popularity was classified as popular.
We found that create-ecdh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.