Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
scrypt-async-modern
Advanced tools
Fast "async" scrypt implementation in modern JavaScript.
Works in browsers without throwing "kill slow script" warnings due to configurable interruptStep, which yields from calculation. Also works with Node.js (but you should really use the C implementation for that).
Yarn:
$ yarn add scrypt-async-modern
NPM:
$ npm install scrypt-async-modern
To improve performance with small interruptStep values, use setImmediate
shim,
such as https://github.com/YuzuJS/setImmediate.
scrypt(password, salt, options)
: Promise
Derives a key from password and salt and fulfills a Promise with the derived key as the only argument.
If options.interruptStep is set, calculations are interrupted with setImmediate (or zero setTimeout) at the given interruptSteps to avoid freezing the browser. If it's not set or set to zero, the callback is called immediately after the calculation, avoiding setImmediate.
password
: string
or Array
of bytes or Uint8Array
salt
: string
or Array
of bytes or Uint8Array
options
: object with key derivation options (see below)N
: CPU/memory cost parameter, must be power of two (default = 16384),
alternatively you can specify logN
where N = 2^logNr
: block size parameter (default = 8)p
: parallelization parameter (default = 1)dkLen
: derived key length (default = 32)interruptStep
: (optional) the amount of loop cycles to execute before the next setImmediate/setTimeout (defaults = 0)encoding
: (optional) result encoding 'base64'
or 'hex'
(result will be a string
), 'binary'
(result will be a Uint8Array
) or undefined (result will be an Array
of bytes, default).const derivedKey = await scrypt("mypassword", "saltysalt", {
N: 16384,
r: 8,
p: 1,
dkLen: 16,
encoding: "hex"
});
console.log(derivedKey); // "5012b74fca8ec8a4a0a62ffdeeee959d"
Fork of dchest/scrypt-async-js.
MIT license.
3.0.10 - 2019-01-05
FAQs
Fast "async" scrypt implementation in modern JavaScript.
The npm package scrypt-async-modern receives a total of 1,198 weekly downloads. As such, scrypt-async-modern popularity was classified as popular.
We found that scrypt-async-modern demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.