Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
The hasha npm package is a Node.js module used for generating hashes from strings, buffers, or streams. It supports various hashing algorithms and can be used for tasks such as checksum generation, file integrity verification, and password hashing.
String Hashing
Hash a string using a specified algorithm. In this example, the string 'unicorn' is hashed using the MD5 algorithm.
const hasha = require('hasha');
const hash = hasha('unicorn', {algorithm: 'md5'});
console.log(hash); //=> '1abcb33beeb811dca15f0ac3e47b88d9'
Buffer Hashing
Hash a buffer using a specified algorithm. Here, a buffer containing the string 'unicorn' is hashed using the SHA-256 algorithm.
const hasha = require('hasha');
const buffer = Buffer.from('unicorn');
const hash = hasha(buffer, {algorithm: 'sha256'});
console.log(hash); //=> 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
Stream Hashing
Generate a hash for the content of a stream. In this code sample, the content of 'unicorn.txt' is hashed using the SHA-512 algorithm.
const hasha = require('hasha');
const fs = require('fs');
const stream = fs.createReadStream('unicorn.txt');
hasha.fromStream(stream, {algorithm: 'sha512'}).then(hash => {
console.log(hash); //=> 'hash of the stream content'
});
File Hashing
Create a hash for the content of a file. This example demonstrates hashing the content of 'unicorn.txt' using the MD5 algorithm.
const hasha = require('hasha');
hasha.fromFile('unicorn.txt', {algorithm: 'md5'}).then(hash => {
console.log(hash); //=> 'hash of the file content'
});
Hashing with Multiple Algorithms
Hash a value using multiple algorithms at once. The string 'unicorn' is hashed using both MD5 and SHA-1 algorithms, and the result is an array of hashes.
const hasha = require('hasha');
const hashes = hasha('unicorn', {algorithm: ['md5', 'sha1']});
console.log(hashes); //=> ['md5 hash', 'sha1 hash']
The 'crypto' module is a built-in Node.js module that provides cryptographic functionality. It includes a diverse set of cryptographic functions, including hash, HMAC, cipher, decipher, sign, and verify. Compared to hasha, 'crypto' is more comprehensive but also more complex to use for simple hashing tasks.
The 'md5' npm package is a simple module to calculate MD5 hashes. It is more limited than hasha as it only supports the MD5 algorithm, whereas hasha supports multiple algorithms.
The 'bcrypt' npm package is designed for hashing passwords. It automatically handles salt generation and is resistant to rainbow table attacks. While hasha can be used for password hashing, 'bcrypt' is specifically optimized for this purpose and includes additional security features.
The 'sha.js' npm package is a module for hashing with SHA algorithms. It supports SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. While hasha also supports these algorithms, 'sha.js' is focused solely on the SHA family of hashes.
Hashing made simple. Get the hash of a buffer/string/stream/file.
Convenience wrapper around the core crypto
Hash class with simpler API and better defaults.
npm install hasha
import {hash} from 'hasha';
await hash('unicorn');
//=> 'e233b19aabc7d5e53826fb734d1222f1f0444c3a3fc67ff4af370a66e7cadd2cb24009f1bc86f0bed12ca5fcb226145ad10fc5f650f6ef0959f8aadc5a594b27'
See the Node.js crypto
docs for more about hashing.
The operation is executed using worker_threads
. A thread is lazily spawned on the first operation and lives until the end of the program execution. It's unrefed, so it won't keep the process alive.
Returns a hash asynchronously.
Returns a hash.
Type: Uint8Array | string | Array<Uint8Array | string> | NodeJS.ReadableStream
(NodeJS.ReadableStream
is not available in hashSync
)
The value to hash.
While strings are supported you should prefer buffers as they're faster to hash. Although if you already have a string you should not convert it to a buffer.
Pass an array instead of concatenating strings and/or buffers. The output is the same, but arrays do not incur the overhead of concatenation.
Type: object
Type: string
Default: 'hex'
Values: 'hex' | 'base64' | 'buffer' | 'latin1'
The encoding of the returned hash.
Type: string
Default: 'sha512'
Values: 'md5' | 'sha1' | 'sha256' | 'sha512'
(Platform dependent)
The md5
algorithm is good for file revving, but you should never use md5
or sha1
for anything sensitive. They're insecure.
The operation is executed using worker_threads
. A thread is lazily spawned on the first operation and lives until the end of the program execution. It's unrefed, so it won't keep the process alive.
Returns a Promise
for the calculated file hash.
import {hashFile} from 'hasha';
// Get the MD5 hash of an image
await hashFile('unicorn.png', {algorithm: 'md5'});
//=> '1abcb33beeb811dca15f0ac3e47b88d9'
Returns the calculated file hash.
import {hashFileSync} from 'hasha';
// Get the MD5 hash of an image
hashFileSync('unicorn.png', {algorithm: 'md5'});
//=> '1abcb33beeb811dca15f0ac3e47b88d9'
Returns a hash transform stream.
import {hashingStream} from 'hasha';
// Hash the process input and output the hash sum
process.stdin.pipe(hashingStream()).pipe(process.stdout);
FAQs
Hashing made simple. Get the hash of a buffer/string/stream/file.
The npm package hasha receives a total of 5,726,314 weekly downloads. As such, hasha popularity was classified as popular.
We found that hasha demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.