Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The js-sha1 npm package is a JavaScript implementation of the SHA-1 hash function. It allows you to generate SHA-1 hashes from strings, arrays, and array buffers. This package is useful for cryptographic operations, data integrity checks, and other scenarios where SHA-1 hashing is required.
Hashing a String
This feature allows you to generate a SHA-1 hash from a string. The code sample demonstrates how to hash the string 'Hello, World!' and print the resulting hash.
const sha1 = require('js-sha1');
const hash = sha1('Hello, World!');
console.log(hash); // '943a702d06f34599aee1f8da8ef9f7296031d699'
Hashing an Array
This feature allows you to generate a SHA-1 hash from an array of bytes. The code sample demonstrates how to hash the array [0x61, 0x62, 0x63] and print the resulting hash.
const sha1 = require('js-sha1');
const hash = sha1([0x61, 0x62, 0x63]);
console.log(hash); // 'a9993e364706816aba3e25717850c26c9cd0d89d'
Hashing an ArrayBuffer
This feature allows you to generate a SHA-1 hash from an ArrayBuffer. The code sample demonstrates how to hash an ArrayBuffer containing the bytes [0x61, 0x62, 0x63] and print the resulting hash.
const sha1 = require('js-sha1');
const buffer = new ArrayBuffer(3);
const view = new Uint8Array(buffer);
view[0] = 0x61;
view[1] = 0x62;
view[2] = 0x63;
const hash = sha1(buffer);
console.log(hash); // 'a9993e364706816aba3e25717850c26c9cd0d89d'
CryptoJS is a widely-used library that provides a variety of cryptographic algorithms, including SHA-1, SHA-256, MD5, and more. It offers a more comprehensive set of cryptographic functions compared to js-sha1, making it suitable for applications that require multiple types of hashing and encryption.
Hash.js is a library that provides a variety of hash functions, including SHA-1, SHA-256, and SHA-512. It is similar to js-sha1 in that it focuses on hashing, but it offers a broader range of hash functions, making it more versatile for different cryptographic needs.
Sha.js is a simple library that provides SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 hash functions. It is similar to js-sha1 but offers additional SHA variants, making it a good choice for applications that require different SHA algorithms.
A simple SHA1 hash function for JavaScript supports UTF-8 encoding.
SHA1 Online SHA1 File Checksum Online
You can also install js-sha1 by using Bower.
bower install js-sha1
For node.js, you can use this command to install:
npm install js-sha1
NIST formally deprecated use of SHA-1 in 2011 and disallowed its use for digital signatures in 2013, and declared that it should be phased out by 2030. However, SHA-1 is still secure for HMAC. wiki
You could use like this:
sha1('Message to hash');
var hash = sha1.create();
hash.update('Message to hash');
hash.hex();
// HMAC
sha1.hmac('key', 'Message to hash');
var hash = sha1.hmac.create('key');
hash.update('Message to hash');
hash.hex();
If you use node.js, you should require the module first:
var sha1 = require('js-sha1');
If you use TypeScript, you can import like this:
import { sha1 } from 'js-sha1';
It supports AMD:
require(['your/path/sha1.js'], function(sha1) {
// ...
});
sha1(''); // da39a3ee5e6b4b0d3255bfef95601890afd80709
sha1('The quick brown fox jumps over the lazy dog'); // 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
sha1('The quick brown fox jumps over the lazy dog.'); // 408d94384216f890ff7a0c3528e8bed1e0b01621
// It also supports UTF-8 encoding
sha1('中文'); // 7be2d2d20c106eee0836c9bc2b939890a78e8fb3
// It also supports byte `Array`, `Uint8Array`, `ArrayBuffer`
sha1([]); // da39a3ee5e6b4b0d3255bfef95601890afd80709
sha1(new Uint8Array([])); // da39a3ee5e6b4b0d3255bfef95601890afd80709
// Different output
sha1(''); // da39a3ee5e6b4b0d3255bfef95601890afd80709
sha1.hex(''); // da39a3ee5e6b4b0d3255bfef95601890afd80709
sha1.array(''); // [218, 57, 163, 238, 94, 107, 75, 13, 50, 85, 191, 239, 149, 96, 24, 144, 175, 216, 7, 9]
sha1.digest(''); // [218, 57, 163, 238, 94, 107, 75, 13, 50, 85, 191, 239, 149, 96, 24, 144, 175, 216, 7, 9]
sha1.arrayBuffer(''); // ArrayBuffer
// HMAC
sha1.hmac.hex('key', 'Message to hash');
sha1.hmac.array('key', 'Message to hash');
// ...
The project is released under the MIT license.
The project's website is located at https://github.com/emn178/js-sha1
Author: Chen, Yi-Cyuan (emn178@gmail.com)
v0.7.0 / 2024-01-24
new Buffer
, replace with Buffer.from
. #10eval
and use require
directly. #8FAQs
A simple SHA1 hash function for JavaScript supports UTF-8 encoding.
The npm package js-sha1 receives a total of 149,611 weekly downloads. As such, js-sha1 popularity was classified as popular.
We found that js-sha1 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.