Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Typescript library of crypto standards. Ready for AOT and treeshaking in combination with Angular and other modern typescript frameworks.
Requirements:
npm install crypto-ts
ES6 import for typical API call signing use case:
import { AES } from 'crypto-ts';
const encryptedMessage = AES.encrypt('message', 'test').toString();
Modular include:
var AES = require("crypto-ts").AES;
var SHA256 = require("crypto-ts").SHA256;
...
console.log(SHA256("Message"));
Including all libraries, for access to extra methods:
var CryptoTS = require("crypto-ts");
...
console.log(CryptoTS.HmacSHA1("Message", "Key"));
Requirements:
bower install crypto-ts
Modular include:
require.config({
packages: [
{
name: 'crypto-ts',
location: 'path-to/bower_components/crypto-ts',
main: 'index'
}
]
});
require(["crypto-ts/algo/aes", "crypto-ts/algo/sha256"], function (AES, SHA256) {
console.log(SHA256("Message"));
});
Including all libraries, for access to extra methods:
// Above-mentioned will work or use this simple form
require.config({
paths: {
'crypto-ts': 'path-to/bower_components/crypto-ts/crypto-ts'
}
});
require(["crypto-ts"], function (CryptoTS) {
console.log(CryptoTS.MD5("Message"));
});
<script type="text/javascript" src="path-to/bower_components/crypto-ts/crypto-ts.js"></script>
<script type="text/javascript">
var encrypted = CryptoTS.AES(...);
var encrypted = CryptoTS.SHA256(...);
</script>
var CryptoTS = require("crypto-ts");
// Encrypt
var ciphertext = CryptoTS.AES.encrypt('my message', 'secret key 123');
// Decrypt
var bytes = CryptoTS.AES.decrypt(ciphertext.toString(), 'secret key 123');
var plaintext = bytes.toString(CryptoTS.enc.Utf8);
console.log(plaintext);
var CryptoTS = require("crypto-ts");
var data = [{id: 1}, {id: 2}]
// Encrypt
var ciphertext = CryptoTS.AES.encrypt(JSON.stringify(data), 'secret key 123');
// Decrypt
var bytes = CryptoTS.AES.decrypt(ciphertext.toString(), 'secret key 123');
var decryptedData = JSON.parse(bytes.toString(CryptoTS.enc.Utf8));
console.log(decryptedData);
crypto-ts/core
crypto-ts/x64-core
crypto-ts/lib-typedarrays
crypto-ts/md5
crypto-ts/sha1
crypto-ts/sha256
crypto-ts/sha224
crypto-ts/sha512
crypto-ts/sha384
crypto-ts/sha3
crypto-ts/ripemd160
crypto-ts/hmac-md5
crypto-ts/hmac-sha1
crypto-ts/hmac-sha256
crypto-ts/hmac-sha224
crypto-ts/hmac-sha512
crypto-ts/hmac-sha384
crypto-ts/hmac-sha3
crypto-ts/hmac-ripemd160
crypto-ts/pbkdf2
crypto-ts/aes
crypto-ts/tripledes
crypto-ts/rc4
crypto-ts/rabbit
crypto-ts/rabbit-legacy
crypto-ts/evpkdf
crypto-ts/format-openssl
crypto-ts/format-hex
crypto-ts/enc-latin1
crypto-ts/enc-utf8
crypto-ts/enc-hex
crypto-ts/enc-utf16
crypto-ts/enc-base64
crypto-ts/mode-cfb
crypto-ts/mode-ctr
crypto-ts/mode-ctr-gladman
crypto-ts/mode-ofb
crypto-ts/mode-ecb
crypto-ts/pad-pkcs7
crypto-ts/pad-ansix923
crypto-ts/pad-iso10126
crypto-ts/pad-iso97971
crypto-ts/pad-zeropadding
crypto-ts/pad-nopadding
FAQs
Typescript library of crypto standards.
We found that crypto-ts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.