
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
cryptomancy-shard
Advanced tools
For secret-sharing schemes which need support for threshold recombination there's cryptomancy-secret. If your needs are incredibly simple, this module may provide a simpler option.
Its goal is to be:
It's missing:
// the API takes and outputs Uint8Arrays
// so you'll probably want to convert between that and different formats
var Format = require("cryptomancy-format");
// it expects you to supply your own randomness
// so it can be deterministic if that suits your needs
// otherwise use a cryptographically secure source of random bytes
var Source = require("cryptomancy-source");
var secure_bytes = Source.bytes.secure();
var plaintext = "PEW PEW PEW";
var u8_message = Format.decodeUTF8(plaintext);
// load the library
var Shard = require("cryptomancy-shard");
// split the plaintext up into 5 shards
// all of which are necessary to reproduce the original value
var shards = Shard.split(secure_bytes, u8_message, 5);
// print out your shards in whatever format you like
// I like base64 because they're probably not valid UTF8
// and I don't like hex
console.log(shards.map(Format.encode64));
// join the shards
// order doesn't matter because internally it's just xor'ing the values
var recovered = Format.encodeUTF8(Shard.join(shards));
console.log(recovered);
FAQs
really basic secret sharing based on xor
The npm package cryptomancy-shard receives a total of 5 weekly downloads. As such, cryptomancy-shard popularity was classified as not popular.
We found that cryptomancy-shard demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.