Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
An unofficial TypeScript SDK for Troy Hunt's Have I been pwned? service.
In Node.js:
npm install hibp
In Deno:
// Replace x.y.z with the desired hibp version
import * as hibp from 'npm:hibp@x.y.z';
See the browser section below for information on how to use it in the browser.
// import individual modules as needed
import { dataClasses, search } from 'hibp';
// or, import all modules into a local namespace
import * as hibp from 'hibp';
// require individual modules as needed
const { dataClasses, search } = require('hibp');
// or, require all modules into a local namespace
const hibp = require('hibp');
The following modules are available:
Please see the API reference for more detailed usage information and examples.
import { search } from 'hibp';
async function main() {
try {
const data = await search('someAccountOrEmail', { apiKey: 'my-api-key' });
if (data.breaches || data.pastes) {
// Bummer...
console.log(data);
} else {
// Phew! We're clear.
console.log('Good news — no pwnage found!');
}
} catch (err) {
// Something went wrong.
console.log(err.message);
}
}
main();
The haveibeenpwned.com API rate limits requests to prevent abuse. In
the event you get rate limited, the module will throw a custom RateLimitError
which will include a
retryAfterSeconds
property so you know when you can try the call again (as a number
, unless the
remote API did not provide one, in which case it will be undefined
- but that should never
happen).
You have several options for using this library in a browser environment:
Bundled
The most efficient and recommended method is to bundle it with client-side code using a module bundler like webpack or, more likely, whatever your framework of choice uses under the hood.
UMD
There is also a Universal Module Definition (UMD) build provided for usage in the browser. When
using this build, an hibp
object will be added to the browser's window
object.
The recommended way to include the UMD build (when using a <script>
tag) is to use the
unpkg CDN, specifying the exact version you want. If you don't specify a version, the
latest
tag will be used, which could be dangerous if/when there are breaking changes made to
the API. See unpkg for details and advanced version specification, but generally you
will want to do the following (replacing x.y.z
with the version you want):
<script src="https://unpkg.com/hibp@x.y.z"></script>
ESM for Browsers
Modern browsers now support importing ECMAScript modules via
<script type="module">
tags. Like the UMD option above, this build is also available the
unpkg CDN (and the same versioning rules apply), but you must specify the full path
(including the file extension). For example:
<script type="module">
// Replace x.y.z with the desired hibp version ↓ ↓ ↓
import { dataClasses } from 'https://unpkg.com/hibp@x.y.z/dist/browser/hibp.module.js';
const logDataClasses = async () => {
console.table(await dataClasses());
};
logDataClasses();
</script>
For more information on ESM in the browser, check out Using JS modules in the browser.
Test hibp in your browser with RunKit.
Send me a PR or an email and I'll add yours to the list!
This module is distributed under the MIT License.
Thanks goes to these wonderful people (emoji key):
Justin Hall 💻 📖 🚇 🚧 👀 ⚠️ | Troy Hunt 🔣 | Jelle Kralt 💻 | Anton W 🐛 | Daniel Adams 💻 | Markus Dolic 🐛 | Jonathan Sharpe 💻 |
Ryan 🐛 | Stuart McGregor 🐛 |
This project follows the all-contributors specification. Contributions of any kind welcome!
14.1.2
f212d87
Thanks @wKovacs64! - Fix error handling for 401 Unauthorized API responses. The haveibeenpwned.com API (v3) changed its response type from a JSON body to text.FAQs
An unofficial TypeScript SDK for the 'Have I been pwned?' service.
The npm package hibp receives a total of 5,636 weekly downloads. As such, hibp popularity was classified as popular.
We found that hibp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.