
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()
This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()
var pbkdf2 = require('pbkdf2')
var derivedKey = pbkdf2.pbkdf2Sync('password', 'salt', 1, 32, 'sha512')
...
For more information on the API, please see the relevant Node documentation.
For high performance, use the async variant (pbkdf2.pbkdf2), not pbkdf2.pbkdf2Sync; this variant has the oppurtunity to use window.crypto.subtle when browserified.
This module is a derivative of cryptocoinjs/pbkdf2-sha256, so thanks to JP Richardson for laying the ground work.
Thank you to FangDun Cai for donating the package name on npm, if you're looking for his previous module it is located at fundon/pbkdf2.
bcrypt is a popular npm package used for hashing passwords. It is based on the Blowfish cipher and includes a salt to protect against rainbow table attacks. Unlike pbkdf2, bcrypt has its own built-in salt generation and a simpler API for hashing and comparing passwords.
argon2 is another npm package that provides password hashing. It is the winner of the Password Hashing Competition and is recommended for new applications over pbkdf2 and bcrypt. Argon2 has better resistance to GPU cracking attacks and offers multiple variants for different use cases.
scrypt is a password-based key derivation function that is designed to be far more secure against hardware brute-force attacks than alternative functions such as pbkdf2. It is also available as an npm package and is used for secure password hashing by requiring more memory to perform the hash.
FAQs
This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()
The npm package pbkdf2 receives a total of 11,186,967 weekly downloads. As such, pbkdf2 popularity was classified as popular.
We found that pbkdf2 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.