
Product
Introducing Supply Chain Attack Campaigns Tracking in the Socket Dashboard
Campaign-level threat intelligence in Socket now shows when active supply chain attacks affect your repositories and packages.
Keychain that derives deterministic Ed25519 keypairs for Hypercore
npm install hyperkeys
const Keychain = require('hyperkeys')
const keys = new Keychain()
const cur = keys.get() // returns the current keypair instance
const foo = keys.get('foo') // tweaks and returns a keypair instancoe for 'foo'
const sub = keys.sub('bar') // get a sub keychain tweaked by 'bar'
const subsub = sub.sub('baz') // sub the the sub chain
// to sign things
const sig = cur.sign(message)
const publicKey = cur.publicKey
keys = new Keychain(publicKeyOrKeyPair)Make a new Keychain instance.
const keys = new Keychain() // generates a fresh keypair for you
const keys = new Keychain(publicKey) // generate a "readonly" keychain
const keys = new Keychain(keyPair) // generate a keychain from a keypair
keys.homePoints to the keypair that was used to construct the Keychain.
keys.basePoints to current checkout, or home if not checkout was made.
keys.tweakPoints to the current tweak used.
keys.headThe key pair of this chain, basically base + tweak.
keys = Keychain.from(keyChainOrPublicKeyOrKeyPair)Same as above, except it will return the Keychain if passed to it. Useful to avoid a peer dependency on the Keychain in your application, ie
const Keychain = require('hyperkeys')
function myModule (keychain) {
const keys = Keychain.from(keychain) // ensures the version of keys is the one you installed
}
keyPairInstance = keys.get([nameOrKeyPair])Get a new KeyPair instance from the Keychain. Optionally you can provide a name or key pair to tweak the keypair before returning it.
const k = keys.get() // get a keypair instance from the current head
const k = keys.get('name') // tweak it with "name" first
const k = keys.get(keyPair) // tweak it with this keypair first
keychain = keys.sub(nameOrKeyPair)Make a new sub Keychain, tweaked from a name or key pair.
const keychain = keys.sub('name') // tweak the current keychain
const keychain = keys.sub({ publicKey: ... }) // new "readonly" keychain
const keychain = keys.sub({ publicKey: ..., scalar: ... }) // same as above to "writable" as well
Note that the following keypairs are equivalent
const k = keys.get('name')
const k = keys.sub('name').get()
All tweaks are "one way", meaning the actual tweak used is
tweakSeed = blake2b([currentTweak ? currentTweak.publicKey : blank, tweakInput])
Ie, you need to know the previous tweak to get to it.
keychain = keys.checkout(publicKeyOrKeyPair)Get a new Keychain, based on an "absolute" keypair or public key. This preserves the "home" pointer, meaning you can get from a checkout to your home keychain by doing
const c = keys.checkout(somePublicKey)
// go back to home
const h = c.checkout(c.home)
MIT
FAQs
Keychain that derives deterministic keypairs
We found that hyperkeys demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Campaign-level threat intelligence in Socket now shows when active supply chain attacks affect your repositories and packages.

Research
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.

Security News
Node.js 25.4.0 makes require(esm) stable, formalizing CommonJS and ESM compatibility across supported Node versions.