
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A native Node module to get, add, replace, and delete passwords in system's keychain. On OS X the passwords are managed by the Keychain, on Linux they are managed by Gnome Keyring and on Windows they are managed by Credential Vault.
npm install keytar
Currently this library uses the gnome-keyring so you may need to run sudo apt-get install libgnome-keyring-dev before npm installing.
If you are using a Red Hat-based system you need to run sudo yum install libgnome-keyring-devel.
npm installgrunt to compile the native and CoffeeScript codegrunt test to run the specskeytar = require 'keytar'
Get the stored password for the service and account.
service - The string service name.
account - The string account name.
Returns the string password or null on failures.
Add the password for the service and account to the keychain.
service - The string service name.
account - The string account name.
password - The string password.
Returns true on success, false on failure.
Delete the stored password for the service and account.
service - The string service name.
account - The string account name.
Returns the string password or null on failures.
Replace the password for the service and account in the keychain.
This is a simple convenience function that internally calls
deletePassword(service, account) followed by
addPassword(service, account, password).
service - The string service name.
account - The string account name.
password - The string password.
Returns true on success, false on failure.
Find a password for the service in the keychain.
service - The string service name.
Returns the string password or null on failures.
FAQs
Bindings to native Mac/Linux/Windows password APIs
We found that keytar3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.