Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The jsbn library is a fast, portable implementation of large-number math in pure JavaScript, enabling public-key crypto and other applications on desktop and mobile browsers.
The jsbn npm package is a library that implements big number arithmetic and RSA encryption. It is useful for cryptography and other applications that require manipulation of large integers that are beyond the native JavaScript Number limit.
Big Number Arithmetic
This feature allows for the addition, subtraction, multiplication, division, and modulus operations on large integers.
var BigInteger = require('jsbn').BigInteger;
var a = new BigInteger('91823918239182398123');
var b = new BigInteger('98237283728372873232');
var sum = a.add(b); // Addition
var difference = a.subtract(b); // Subtraction
var product = a.multiply(b); // Multiplication
var quotient = a.divide(b); // Division
var remainder = a.mod(b); // Modulus
RSA Encryption
This feature allows for RSA encryption and decryption, which is useful for secure data transmission.
var BigInteger = require('jsbn').BigInteger;
var RSAKey = require('jsbn').RSAKey;
var key = new RSAKey();
key.setPublic('...public exponent...', '...modulus...');
var encrypted = key.encrypt('text to encrypt');
key.setPrivate('...modulus...', '...public exponent...', '...private exponent...');
var decrypted = key.decrypt(encrypted);
bignumber.js is a JavaScript library for arbitrary-precision decimal and non-decimal arithmetic. It provides similar big number arithmetic capabilities as jsbn but with a focus on decimal arithmetic and more extensive API for different mathematical operations.
node-rsa is a Node.js RSA library that provides similar RSA encryption and decryption functionalities as jsbn. It offers a more user-friendly API and additional features such as key generation, signing, and verification.
forge is a JavaScript library that provides a wide range of cryptographic operations including big number arithmetic and RSA encryption. It is more comprehensive than jsbn, offering additional features like symmetric encryption, hashing, and TLS support.
I felt compelled to put this on github and publish to npm. I haven't tested every other big integer library out there, but the few that I have tested in comparison to this one have not even come close in performance. I am aware of the bi
module on npm, however it has been modified and I wanted to publish the original without modifications. This is jsbn and jsbn2 from Tom Wu's original website above, with the module pattern applied to prevent global leaks and to allow for use with node.js on the server side.
var BigInteger = require('jsbn').BigInteger;
var bi = new BigInteger('91823918239182398123');
console.log(bi.bitLength()); // 67
returns the base-10 number as a string
returns a new BigInteger equal to the negation of bi
returns new BI of absolute value
FAQs
The jsbn library is a fast, portable implementation of large-number math in pure JavaScript, enabling public-key crypto and other applications on desktop and mobile browsers.
The npm package jsbn receives a total of 29,615,211 weekly downloads. As such, jsbn popularity was classified as popular.
We found that jsbn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.