
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A library for creating node oidc-lib credential issuer services
$ mkdir test-issuer
$ cd test-issuer
$ npm init
NOTE: simply press return to accept defaults
package name: (test-issuer)
version: (1.0.0)
description:
entry point: (index.js)
test command:
git repository:
keywords:
author:
license: (ISC)
About to write to C:\Users\KimCameron\Documents\git\oidc-playground\test2\package.json:
{
"name": "test-issuer",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC"
}
Is this OK? (yes) y
$
$ npm install -s oidc-lib
.
. (files are installed)
.
/////////////////////////////////////////////////////////////////
INPUT REQUIRED
/////////////////////////////////////////////////////////////////
Use the default hostname of virtual.itsourweb.org? (Y/N) Y
This installs the library and configures it to use 'virtual.itsourweb.org' as the hostname for its service.
Note: if you choose to use a hostname that is not within 'itsourweb.org', you must obtain and install an https certificate for your hostname or its domain. You will then be able to access your service from anywhere on the internet by configuring the DNS for your hostname to route to your server. However we recommend you avoid this until you are familiar with how oidc-lib works using the defaults.
For example, on Ubuntu, edit /etc/hosts to include your chosen domain:
$cat /etc/hosts
127.0.0.1 localhost
127.0.0.1 virtual.itsourweb.org
On windows, edit /windows/system32/drivers/etc/hosts as administrator:
C:\windows\system32>type drivers\etc\hosts
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
127.0.0.1 virtual.itsourweb.org
$ node index.js
oidc_lib starting up at Fri Nov 20 2020 19:52:33 GMT-0500 (Eastern Standard Time)
Initializing FileDb in content module sts
Keys loaded and ready to start server
Https server started on port 3000
Http server started on port 3001
This is the correct result. But while we have a server, we have not yet set up a credential issuser.
Use Control-C or equivalent to terminate the server. Then import a demo credential issuer so you can try issuing a credential into a wallet.
$ npm run import
What package file contains the credential issuer or module you want to add?
covid_cred
The credential issuer is currently called "covid_cred".
You can change it's name but will have to rename and edit 'covid_cred.js'
Press "Y" to retain the issuer name, or "N" to change it. (Y/N) Y
Press "Y" to proceed, "N" to exit. (Y/N) Y
Done
$ node index
oidc_lib starting up at Fri Nov 20 2020 04:47:30 GMT+0000
Loaded content module: covid_cred
Initializing FileDb in content module sts
Initializing FileDb in content module covid_cred
[ClientLib] Success loading keystore - covid_cred:privateOmniKey
[ClientLib] Success loading keystore - covid_cred:integrityKey
Keys loaded and ready to start server
Https server started on port 3000
Http server started on port 3001
Your credential issuer is now ready to issue credentials.
We created a directory and initialized it with npm. We used npm to install oidc-lib in that directory. We set up the 'hosts' file to route our hostname to our server. We terminated our service with a Control C, used 'npm run import' to add a credential issuer to our service, and resetarted the service with 'node index'.
These steps created a node_modules directory containing oidc-lib and all its dependencies. Our directory, initially empty, now contains something similar to:
$ dir
11/29/2020 06:32 PM <DIR> .
11/29/2020 06:32 PM <DIR> ..
11/29/2020 08:59 AM <DIR> covid_cred
11/27/2020 03:37 PM 161 index.js
11/29/2020 06:32 PM <DIR> node_modules
11/27/2020 03:38 PM <DIR> oidc_lib_data
11/29/2020 06:32 PM 164,486 package-lock.json
11/29/2020 06:32 PM 568 package.json
11/27/2020 03:37 PM <DIR> views
11/29/2020 09:21 AM <DIR> web
The issuer is now working, so start up a wallet.
Begin by running chrome on the same computer the service runs on. Browse to:
https://virtual.itsourweb.org:3000/wallet/wallet.html
A wallet will be installed that can be used to request and present verifiable credentials.
FAQs
A library for creating OIDC Service Providers
We found that oidc-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.