Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
jose-chacha
Advanced tools
ChaCha derived AEAD algorithms extension for the jose module
This is a plugin for the jose
package that implements the following Individual Draft
ChaCha derived AEAD algorithms in JSON Object Signing and Encryption (JOSE)
source: https://tools.ietf.org/html/draft-amringer-jose-chacha-01
The following new algorithms are available
C20P
content encryption algorithmXC20P
content encryption algorithmC20PKW
content encryption key wrapping algorithmXC20PKW
content encryption key wrapping algorithmECDH-ES+C20PKW
Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral StaticECDH-ES+XC20PKW
Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral StaticAEAD_XCHACHA20_POLY1305
is not available in OpenSSL bundled with Node.js yet, in the plugin
this cipher is handled via libsodium.Installing
npm install jose // jose ^1.16.0 || ^2.0.1 declared as a peer dependency
npm install jose-chacha
const jose = require('jose')
const chacha = require('jose-chacha')
;(async () => {
await chacha // wait for libsodium to be ready!
{
const key = jose.JWK.generateSync('oct', 256)
console.log(key.algorithms())
console.log(jose.JWE.encrypt('foobar', key, { alg: 'dir', enc: 'XC20P' }))
}
{
const key = jose.JWK.generateSync('EC', 'P-256')
console.log(key.algorithms())
console.log(jose.JWE.encrypt('foobar', key, { alg: 'ECDH-ES+XC20PKW', enc: 'XC20P' }))
}
})()
Note: This plugin only supports Node.js runtime >= 12.0.0 and Electron >= 6.0.0
Have a question about using jose
? - ask.
Found a bug? - report it.
Missing a feature? - If it wasn't already discussed before, ask for it.
Found a vulnerability? - Reach out to us via email first, see security vulnerability disclosure.
If you or your business use jose
, please consider becoming a sponsor so I can continue maintaining it and adding new features carefree.
FAQs
ChaCha derived AEAD algorithms extension for the jose module
We found that jose-chacha demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.