Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Implementation of Master Password for nodejs and browser
$ npm install --save node-mpw
import mpw from 'node-mpw'
mpw.generateKey(name: string, password: string, version?: string, namespace?: string): Buffer
Calculate the master key from a user's name and master password.
name: string
The desired username.password: string
The desired master password.version?: string
The algorithm version being used for this process.namespace? string
The namespace used as a salt to calculate the key.Returns: a key generated from the scrypt
algorithm.
mpw.generatePassword(site: string, key: Buffer, counter?: number, template?: string, version?: number, namespace?: string): string
Encode a site password using the site's type template.
site: string
The site name. The bare domain name is an ideal choice.key: Buffer
An scrypt
-hashed key generated from the generateKey()
function.counter?: number
An integer that can be incremented when the user needs a new password for the site.template?: string
The password template that the user chooses.version?: number
The algorithm version being used for this process.namespace?: string
The namespace used as a salt to calculate the seed.Returns: the final, generated password.
Issues and Pull Requests are welcome! Please read our contributing guidelines & code of conduct beforehand.
We use a few emojis as an identifier on what the commits are. The following commit naming scheme is loosely based on the Commitizen commit naming conventions. Feel free to use this standard as well.
FAQs
Implementation of Master Password for nodejs and browser
The npm package node-mpw receives a total of 3 weekly downloads. As such, node-mpw popularity was classified as not popular.
We found that node-mpw demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.