
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Use
var RC4 = require('simple-rc4');
to import the package.
The constructor call
var rc4 = new RC4(key)
creates a new encryption/decryption instance.
Here key should be a variable of type Buffer or String.
Subsequential calls to rc4.update(msg) encrypt the given argument.
If msg is a Buffer it will be encrypted in place. Messages of type String are converted to Buffers and the encrypted message is given as return value.
var key = new Buffer([1, 2, 3, 4]);
var msg = new Buffer('secret message');
console.log('input: ', msg.toString(), ' == ', msg.toString('hex'));
// create encryption instance
var enc = new RC4(key);
enc.update(msg);
console.log('encrypted: ', msg.toString(), ' == ', msg.toString('hex'));
// create decryption instance (equals encryption instance)
var dec = new RC4(key);
dec.update(msg);
console.log('output: ', msg.toString(), ' == ', msg.toString('hex'));
You can use RC4.Transform to encrypt a readable stream as follows:
var fIn = fs.createReadStream('message.txt'),
fOut = fs.createWriteStream('encrypted_message.txt');
var transform = new RC4.Transform("abcd");
fIn.pipe(transform);
transform.pipe(fOut);
The same procedure can be used to decrypt a given stream:
var fIn = fs.createReadStream('encrypted_message.txt'),
fOut = fs.createWriteStream('decrypted_message.txt');
var transform = new RC4.Transform("abcd");
fIn.pipe(transform);
transform.pipe(fOut);
FAQs
A pure JavaScript implementation of RC4 stream en/decryption
The npm package simple-rc4 receives a total of 32 weekly downloads. As such, simple-rc4 popularity was classified as not popular.
We found that simple-rc4 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.