simple-encryptor - npm Package Compare versions

Comparing version 1.0.1 to 1.0.2

index.js

 var crypto = require('crypto');
+var scmp = require('scmp');
 
@@ -78,2 +79,5 @@ // Arbitrary min length, nothing should shorter than this:
   function decrypt(cipherText) {
+    if( !cipherText ) {
+      return null;
+    }
     try {
@@ -87,3 +91,3 @@ if( verifyHmac ) {
         var actualHmac = hmac(cipherText);
-        if( actualHmac != expectedHmac ) {
+        if( !scmp(actualHmac, expectedHmac) ) {
           throw new Error('HMAC does not match');
@@ -90,0 +94,0 @@ }

package.json

 {
   "name": "simple-encryptor",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Simplified encryption/decryption for node.js",
@@ -29,3 +29,6 @@ "main": "index.js",
     "mocha": "^1.21.0"
+  },
+  "dependencies": {
+    "scmp": "0.0.3"
   }
 }

README.md

@@ -106,5 +106,5 @@ # simple-encryptor
 # Dependencies
-None.
+[scmp](https://www.npmjs.org/package/scmp) for constant-time string comparison.
 
 # License
 This plugin is released under the MIT license. See the file [LICENSE](LICENSE).

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

13066

increased by1.56%

Lines of code

170

increased by2.41%

Worsened metrics

Dependency count

1

increased byInfinity%

Dependency changes

• + Addedscmp@0.0.3

• + Addedscmp@0.0.3(transitive)