Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
The hasha npm package is a Node.js module used for generating hashes from strings, buffers, or streams. It supports various hashing algorithms and can be used for tasks such as checksum generation, file integrity verification, and password hashing.
String Hashing
Hash a string using a specified algorithm. In this example, the string 'unicorn' is hashed using the MD5 algorithm.
const hasha = require('hasha');
const hash = hasha('unicorn', {algorithm: 'md5'});
console.log(hash); //=> '1abcb33beeb811dca15f0ac3e47b88d9'
Buffer Hashing
Hash a buffer using a specified algorithm. Here, a buffer containing the string 'unicorn' is hashed using the SHA-256 algorithm.
const hasha = require('hasha');
const buffer = Buffer.from('unicorn');
const hash = hasha(buffer, {algorithm: 'sha256'});
console.log(hash); //=> 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
Stream Hashing
Generate a hash for the content of a stream. In this code sample, the content of 'unicorn.txt' is hashed using the SHA-512 algorithm.
const hasha = require('hasha');
const fs = require('fs');
const stream = fs.createReadStream('unicorn.txt');
hasha.fromStream(stream, {algorithm: 'sha512'}).then(hash => {
console.log(hash); //=> 'hash of the stream content'
});
File Hashing
Create a hash for the content of a file. This example demonstrates hashing the content of 'unicorn.txt' using the MD5 algorithm.
const hasha = require('hasha');
hasha.fromFile('unicorn.txt', {algorithm: 'md5'}).then(hash => {
console.log(hash); //=> 'hash of the file content'
});
Hashing with Multiple Algorithms
Hash a value using multiple algorithms at once. The string 'unicorn' is hashed using both MD5 and SHA-1 algorithms, and the result is an array of hashes.
const hasha = require('hasha');
const hashes = hasha('unicorn', {algorithm: ['md5', 'sha1']});
console.log(hashes); //=> ['md5 hash', 'sha1 hash']
The 'crypto' module is a built-in Node.js module that provides cryptographic functionality. It includes a diverse set of cryptographic functions, including hash, HMAC, cipher, decipher, sign, and verify. Compared to hasha, 'crypto' is more comprehensive but also more complex to use for simple hashing tasks.
The 'md5' npm package is a simple module to calculate MD5 hashes. It is more limited than hasha as it only supports the MD5 algorithm, whereas hasha supports multiple algorithms.
The 'bcrypt' npm package is designed for hashing passwords. It automatically handles salt generation and is resistant to rainbow table attacks. While hasha can be used for password hashing, 'bcrypt' is specifically optimized for this purpose and includes additional security features.
The 'sha.js' npm package is a module for hashing with SHA algorithms. It supports SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. While hasha also supports these algorithms, 'sha.js' is focused solely on the SHA family of hashes.
Hashing made simple. Get the hash of a buffer/string/stream/file.
Convenience wrapper around the core crypto
Hash class with simpler API and better defaults.
$ npm install hasha
const hasha = require('hasha');
hasha('unicorn');
//=> 'e233b19aabc7d5e53826fb734d1222f1f0444c3a3fc67ff4af370a66e7cadd2cb24009f1bc86f0bed12ca5fcb226145ad10fc5f650f6ef0959f8aadc5a594b27'
const hasha = require('hasha');
(async () => {
console.log(await hasha.async('unicorn'));
//=> 'e233b19aabc7d5e53826fb734d1222f1f0444c3a3fc67ff4af370a66e7cadd2cb24009f1bc86f0bed12ca5fcb226145ad10fc5f650f6ef0959f8aadc5a594b27'
})();
const hasha = require('hasha');
// Hash the process input and output the hash sum
process.stdin.pipe(hasha.stream()).pipe(process.stdout);
const hasha = require('hasha');
(async () => {
// Get the MD5 hash of an image
const hash = await hasha.fromFile('unicorn.png', {algorithm: 'md5'});
console.log(hash);
//=> '1abcb33beeb811dca15f0ac3e47b88d9'
})();
See the Node.js crypto
docs for more about hashing.
Returns a hash.
Type: Buffer | string | Array<Buffer | string>
Buffer you want to hash.
While strings are supported you should prefer buffers as they're faster to hash. Although if you already have a string you should not convert it to a buffer.
Pass an array instead of concatenating strings and/or buffers. The output is the same, but arrays do not incur the overhead of concatenation.
Type: object
Type: string
Default: 'hex'
Values: 'hex' | 'base64' | 'buffer' | 'latin1'
Encoding of the returned hash.
Type: string
Default: 'sha512'
Values: 'md5' | 'sha1' | 'sha256' | 'sha512'
(Platform dependent)
The md5
algorithm is good for file revving, but you should never use md5
or sha1
for anything sensitive. They're insecure.
In Node.js 12 or later, the operation is executed using worker_threads
. A thread is lazily spawned on the first operation and lives until the end of the program execution. It's unrefed, so it won't keep the process alive.
Returns a hash asynchronously.
Returns a hash transform stream.
Returns a Promise
for the calculated hash.
In Node.js 12 or later, the operation is executed using worker_threads
. A thread is lazily spawned on the first operation and lives until the end of the program execution. It's unrefed, so it won't keep the process alive.
Returns a Promise
for the calculated file hash.
Returns the calculated file hash.
FAQs
Hashing made simple. Get the hash of a buffer/string/stream/file.
The npm package hasha receives a total of 1,732,067 weekly downloads. As such, hasha popularity was classified as popular.
We found that hasha demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.