
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
An ultra-lightweight JavaScript library for generating unique, URL-friendly, and time-sortable IDs. Kinoid is designed for Node.js and browser environments, offering decodable, timestamp-based IDs in a compact base36 format.
An ultra-light, url-friendly unique IDs generator. For node and browsers.
The kinoid library generates unique IDs as strings made up of numbers and the 26 lowercase characters of the english alphabet; every string generated by kinoid can be considered as a base36 number.
The generated IDs are unique because, no matter how many IDs are generated, each ID is different from all the others generated before or at the same time on the same machine.
Each ID is composed of a timestamp (representing milliseconds since the UNIX epoch), a number that identifies the process in which the program runs, and a final number which can be said a serialization value or a singularity factor that guarantees the uniqueness of the ID.
IDs are sortable by time, because they are based on the time they were created. Additionally, the
time an ID was created can be calculated from the ID itself thanks to the decodeId() utility which
returns an object containing, among other things, the date on which that ID was generated.
IDs are not passwords! Kinoid ensures that each generated ID is unique, but not necessarily unpredictable.
This depends on a logical limit that affects all libraries: an algorithm that produces unpredictable strings cannot guarantee their uniqueness and, vice versa, an algorithm that produces unique strings cannot guarantee their unpredictability.
Libraries that produce IDs which are both unique and unpredictable typically achieve this by combining two separate algorithms: one that generates a unique string (e.g., based on timestamps or counters) and another that generates an unpredictable string (e.g., using cryptographic randomness). These two strings are then concatenated to form the final ID, ensuring both properties are satisfied.
If you need a library for creating cryptographically secure passwords, consider crypto-pwd-generator
# with npm
npm install kinoid
# with yarn
yarn add kinoid
const { newId, decodeId } = require('kinoid')();
const newBook = {
title: 'The absence of non-existent unthoughts',
author: 'John White',
publisher: 'Hypercubes',
id: newId(),
};
db.add(newBook);
console.log(`Generated id '${id}' on ${decodeId(id).date.toDateString()}`);
// Generated id 'cohb4z87mvoyf1zjy' on Tue Nov 19 2024
import kinoid from 'kinoid';
const { newId, decodeId } = kinoid();
const id = newId();
console.log(id);
// cohb4z87mvoyf1zjy
console.log(`The id '${id}' was generated on ${decodeId(id).date.toDateString()}`);
// The id 'cohb4z87mvoyf1zjy' was generated on Tue Nov 19 2024
console.log(decodeId(id));
// {
// id: 'cohb4z87mvoyf1zjy',
// date: 2024-11-19T16:52:19.962Z,
// singularity: 1144,
// pid: 5438
// }
const invalidId = 'c1vz87moyfzjyoHB4';
console.log(decodeId(invalidId));
// {
// id: 'c1vz87moyfzjyoHB4',
// error: 'the string c1vz87moyfzjyoHB4 is not a valid ID'
// }
<!doctype html>
<html lang="en">
<head>
<title>ID generator</title>
<script src="https://cdn.jsdelivr.net/npm/kinoid@3"></script>
<!--
you may also use
<script src="https://unpkg.com/kinoid@3"></script>
-->
<script>
const { newId, decodeId } = kinoid();
function clickHandler() {
const id = newId();
const idStruct = decodeId(id);
document.getElementById('id-viewer').innerHTML = `
<pre>
ID: <b>${id}</b>
time: ${idStruct.date.toISOString()}
singularity: ${idStruct.singularity}
process: ${idStruct.pid}
</pre>`;
}
</script>
</head>
<body>
<button onclick="clickHandler()">get new ID</button>
<div id="id-viewer" style="font-family: monospace">
<p>here will be an ID</p>
</div>
</body>
</html>
Contributions to this project are welcomed!
Whether you have
please don't hesitate to reach out to me on GitHub and open an issue.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
An ultra-lightweight JavaScript library for generating unique, URL-friendly, and time-sortable IDs. Kinoid is designed for Node.js and browser environments, offering decodable, timestamp-based IDs in a compact base36 format.
We found that kinoid demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.