
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Copy web folder under project directory and paste it on persona_ext project -> node_modules/idsync or persona/
A NodeJS secrets vault.
To use idsync in a NodeJS environment, you can simply install and require it:
npm install idsync --save
In a Node environment, for example:
const { Vault } = require("idsync");
Or for Typescript:
import { Vault } from "idsync";
In a web environment, use the following:
import { Vault } from "idsync/web";
Idsync core supports Node version 12 and up. Most features may work on Node 10, but it is not officially supported.
Idsync uses Vaults, Groups and Entrys to manipulate data in a workspace-like environment. These 3 constructs have no knowledge of encryption or storage, and simply provide interfaces for working with the data structures.
To manage vaults, their storage and their states in a higher-level manner more appropriate for building applications, check out the VaultManager and VaultSource constructs.
To get started, we should create a new Vault:
import { Vault, init } from "idsync";
// Initialise environment
init();
// Create an empty vault
const vault1 = new Vault();
// Create aa vault with "General" and "Trash" groups
const vault2 = Vault.createWithDefaults();
The init() function call is used to initialise the environment (performs the same function as @idsync/app-env used to). It is required for Idsync to work. It can be called more than once without effect.
Entries can't be added directly to a Vault, but can be to Groups. Creating Groups and Entries is trivial:
const vault = Vault.createWithDefaults();
const myGroup = vault.createGroup("My Group");
const myEntry = myGroup.createEntry("My Entry");
Every command on Vaults, Groups and Entries modifies the Vault instance, but does not save it to storage. There is no command or need to commit any data - each instance links back to the original Vault. Vaults are saved and loaded using Datasources:
import { Credentials, FileDatasource, Vault, init } from "idsync";
init();
const datasourceCredentials = Credentials.fromDatasource({
path: "./user.denali"
}, "masterPassword!");
const fileDatasource = new FileDatasource(datasourceCredentials);
const vault = Vault.createWithDefaults();
vault
.createGroup("Websites")
.createEntry("My bank")
.setProperty("username", "user-name")
.setProperty("password", "s3cureP4$$");
const vaultCredentials = Credentials.fromPassword("masterPassword!");
await fileDatasource.save(vault.format.history, vaultCredentials);
Later:
const datasourceCredentials = Credentials.fromDatasource({
path: "./user.denali"
}, "masterPassword!");
const fileDatasource = new FileDatasource(datasourceCredentials);
fileDatasource
.load(datasourceCredentials)
.then(Vault.createFromHistory)
.then(vault => {
// ...
});
Idsync currently supports 2 concurrent vault formats, as it is in the process of transitioning from Format A (legacy) to Format B. You can switch the operational format by doing the following:
const { VaultFormatB, init, setDefaultFormat } = require("idsync");
init();
setDefaultFormat(VaultFormatB);
Idsync will automatically transition to using Format B as the default in some weeks or months (since v5 was released).
Idsync's compatibility is defined as the following:
Browser support is strictly dependent on:
SubtleCryptoFAQs
A NodeJS password vault.
We found that idsync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.