
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
otp-encryption-decryption-lib
Advanced tools
Library of small snippets, tools and helper-functions for encrypting and decrypting messages with OTPs - One-time pads.
Library of small snippets, tools and helper-functions for encrypting and decrypting messages with OTPs - One-time pads.

Will be core functionality together with nfc-json-transfer for creating otp-encryption-toy
const { textToPlaincode, plaincodeToText, createOnetimePad, nob, codebook, checkLength, encryptPlaincode, decryptEncryptedMsg } = require('otp-encryption-decryption-lib')
import { textToPlaincode, plaincodeToText, createOnetimePad, nob, codebook, checkLength, encryptPlaincode, decryptEncryptedMsg } from 'otp-encryption-decryption-lib'
index.mjs:
import { textToPlaincode, plaincodeToText, createOnetimePad, nob, codebook, checkLength, encryptPlaincode, decryptEncryptedMsg } from 'otp-encryption-decryption-lib'
// The message
const txt = 'Hello 👨👩👦👦🏳️🌈😀🇿🇼 world 123 æøå!'
console.log('\n\nInput: ' + txt)
// ### Text to plaincode
const plaincodeConverted = textToPlaincode(txt, nob, codebook)
console.log('Plaincode: ' + plaincodeConverted)
// ### Creating a one-time pad
const otp = createOnetimePad(96)
console.log('One-time pad: ' + otp)
// ### Checking length of plaincode vs. one-time pad
const lengthObj = checkLength(plaincodeConverted, otp)
console.log('Length: ' + JSON.stringify(lengthObj))
// ### Encrypting plaincode
const encryptedMsg = encryptPlaincode(plaincodeConverted, otp)
console.log('Encrypted plaincode: ' + encryptedMsg.join(''))
// ### Decrypting encrypted message
const decryptedPlaincode = decryptEncryptedMsg(encryptedMsg.join(''), otp)
console.log('Decrypted plaincode: ' + decryptedPlaincode.join(''))
// ### Plaincode to text - The message delivered!
const textConverted = plaincodeToText(decryptedPlaincode.join(''), nob, codebook)
console.log('Decrypted msg: ' + textConverted + '\n\n')
When doing ESM-version of the library, run it with:
node --experimental-json-modules index.mjs
textToPlaincode(text, conversionLanguage, codebook)
// Returns plaincode string from text.
plaincodeToText(plaincode, conversionLanguage, codebook)
// Returns text string from plaincode string.
createOnetimePad(length)
// Return a one-time pad of desired length.
eng.textRegex // regex pattern for converting english text, numbers and punctuation into single characters
eng.plaincodeRegex // regex pattern for converting english plaincode string into array of plaincodes
eng.table // unicode <-> plaincode conversion table for english
nob.textRegex // regex pattern for converting norwegian text, numbers and punctuation into single characters
nob.plaincodeRegex // regex pattern for converting norwegian plaincode string into array of plaincodes
nob.table // unicode <-> plaincode conversion table for norwegian
codebook // conversion table for all (almost) unicode emojis <-> plaincode
checkLength(plaincode, otp)
// returns { plaincodeLength: plaincodeLength, otpLength: otpLength, tooLong: tooLong }
Helper function to check if plaincode length (and thus your message length) is too long, and also show the user how close they are to exceed length of one-time pad.
encryptPlaincode(plaincode, otp)
// Returns encrypted message as an array of numbers.
decryptEncryptedMsg(encryptedMsg, otp)
// Returns message as an array of characters.
If unicode emojis are updated (to i.e. v.16 from v.15)
cd scipts
node ./fetch-emojis.mjs && node ./create-emoji-regex.mjs && node ./create-emoji-codebook.mjs
Haven't found a unique way of numbering/addressing the unicode emojis that will work cross unicode emoji versions, so then stuff won't encrypt/decrypt properly if you use different versions of the library.
FAQs
Library of small snippets, tools and helper-functions for encrypting and decrypting messages with OTPs - One-time pads.
We found that otp-encryption-decryption-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.