
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

doip.js allows websites and Node.js projects to verify decentralized online identities.
Documentation available at js.doip.rocks.
Install using yarn or npm:
yarn add doipjs
# or
npm install --save doipjs
Import the doip module in your code:
const doip = require('./doipjs')
Include the following HTML snippet (requires openpgp.js):
<script src="/static/openpgp.min.js"></script>
<script src="/static/doip.min.js"></script>
Run the following javascript:
const verifyIdentity = async (url, fp) => {
const claim = new doip.Claim(url, fp)
claim.match()
await claim.verify()
console.log(claim.toJSON())
}
verifyIdentity('dns:doip.rocks', '9f0048ac0b23301e1f77e994909f6bd6f80f485d')
This snippet verifies the doip.rocks domain as bidirectionally linked to Yarmo's cryptographic key.
Anyone can contribute!
Developers are invited to:
If you are new to contributing to open source software, we'd love to help you! To get started, here's a list of "good first issues" that you could look into.
Everyone is invited to:
Please note that this project has a Code of Conduct that all contributors agree to abide when participating.
The Keyoxide project strives for a healthier internet for all and has made its efforts fully open source. Our community is open and welcoming, feel free to say hi!
Funding for the project comes from the NLnet foundation, NGI0 and the people supporting our OpenCollective. The project is grateful for all your support.
FAQs
Decentralized Online Identity Proofs library in Node.js
The npm package doipjs receives a total of 20 weekly downloads. As such, doipjs popularity was classified as not popular.
We found that doipjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.