Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The keytar npm package is a native module for Node.js that allows you to securely store and retrieve credentials using the operating system's native credential storage mechanisms. It supports macOS, Windows, and Linux, providing a cross-platform solution for managing sensitive information.
Store a password
This feature allows you to store a password securely in the operating system's credential storage. The `setPassword` method takes three arguments: the service name, the account name, and the password.
const keytar = require('keytar');
async function storePassword() {
await keytar.setPassword('service', 'account', 'password');
console.log('Password stored successfully');
}
storePassword();
Retrieve a password
This feature allows you to retrieve a stored password from the operating system's credential storage. The `getPassword` method takes two arguments: the service name and the account name.
const keytar = require('keytar');
async function getPassword() {
const password = await keytar.getPassword('service', 'account');
console.log('Retrieved password:', password);
}
getPassword();
Delete a password
This feature allows you to delete a stored password from the operating system's credential storage. The `deletePassword` method takes two arguments: the service name and the account name.
const keytar = require('keytar');
async function deletePassword() {
const result = await keytar.deletePassword('service', 'account');
console.log('Password deleted:', result);
}
deletePassword();
Find credentials
This feature allows you to find all credentials associated with a specific service. The `findCredentials` method takes one argument: the service name.
const keytar = require('keytar');
async function findCredentials() {
const credentials = await keytar.findCredentials('service');
console.log('Found credentials:', credentials);
}
findCredentials();
The osx-keychain package is another macOS-specific package that allows you to interact with the macOS Keychain. It provides methods to add, find, and delete keychain items. It is similar to keytar but limited to macOS.
The wincred package is a Windows-specific package that allows you to store and retrieve credentials using the Windows Credential Manager. It provides similar functionality to keytar but is limited to the Windows platform.
Get, add, and delete passwords in the Keychain.
npm install keytar
npm install
grunt
to compile the native and CoffeeScript codegrunt test
to run the specsFAQs
Bindings to native Mac/Linux/Windows password APIs
The npm package keytar receives a total of 354,380 weekly downloads. As such, keytar popularity was classified as popular.
We found that keytar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.