Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
crypto-hash
Advanced tools
Tiny hashing module that uses the native crypto API in Node.js and the browser
The crypto-hash npm package is a simple and modern way to create cryptographic hashes in Node.js and the browser. It supports various hashing algorithms like SHA-256, SHA-384, and SHA-512, and provides a promise-based API for asynchronous operations.
Hashing a string
This feature allows you to hash a string using the SHA-256 algorithm. The code sample demonstrates how to hash the string 'Hello, world!' and log the resulting hash.
const cryptoHash = require('crypto-hash');
(async () => {
const hash = await cryptoHash.sha256('Hello, world!');
console.log(hash);
})();
Hashing a file
This feature allows you to hash the contents of a file. The code sample demonstrates how to read a file into a buffer and then hash its contents using the SHA-256 algorithm.
const cryptoHash = require('crypto-hash');
const fs = require('fs');
(async () => {
const fileBuffer = fs.readFileSync('path/to/file.txt');
const hash = await cryptoHash.sha256(fileBuffer);
console.log(hash);
})();
Using different algorithms
This feature allows you to use different hashing algorithms. The code sample demonstrates how to hash the same string using both the SHA-384 and SHA-512 algorithms.
const cryptoHash = require('crypto-hash');
(async () => {
const sha384Hash = await cryptoHash.sha384('Hello, world!');
const sha512Hash = await cryptoHash.sha512('Hello, world!');
console.log('SHA-384:', sha384Hash);
console.log('SHA-512:', sha512Hash);
})();
The built-in 'crypto' module in Node.js provides cryptographic functionality that includes a set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify functions. It is more comprehensive but also more complex to use compared to crypto-hash.
The hash.js package is a JavaScript library that provides a simple way to create cryptographic hashes. It supports a variety of algorithms and is designed to be used both in Node.js and the browser. It is similar to crypto-hash but offers a more extensive set of algorithms.
The bcrypt package is a library to help you hash passwords. While it is specifically designed for password hashing and not general-purpose hashing, it provides a high level of security and is widely used in authentication systems.
Tiny hashing module that uses the native crypto API in Node.js and the browser
Useful when you want the same hashing API in all environments. My cat calls it isomorphic.
In Node.js it uses node:crypto
, while in the browser it uses window.crypto
.
The browser version is only ~300 bytes minified & gzipped.
When used in the browser, it must be in a secure context (HTTPS).
This package is for modern browsers. Internet Explorer is not supported.
npm install crypto-hash
import {sha256} from 'crypto-hash';
console.log(await sha256('🦄'));
//=> '36bf255468003165652fe978eaaa8898e191664028475f83f506dabd95298efc'
Returns a Promise<string>
with a Hex-encoded hash.
In Node.js, the operation is executed using worker_threads
. A thread is lazily spawned on the first operation and lives until the end of the program execution. It's unref
ed, so it won't keep the process alive.
SHA-1 is insecure and should not be used for anything sensitive.
Type: string
ArrayBuffer
ArrayBufferView
Type: object
Type: string
Values: 'hex' | 'buffer'
Default: 'hex'
Setting this to buffer
makes it return an ArrayBuffer
instead of a string
.
FAQs
Tiny hashing module that uses the native crypto API in Node.js and the browser
We found that crypto-hash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.