Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by rdtsc | Hacker News Reader

Parent Full thread

rdtsc·

Also note the same user owns this library:

https://github.com/right9ctrl/node-scrypt

I would be very suspicious of that as well and audit anything that library has touched.

View on HN

Good eyes, but this looks like it may be a red herring. That is a fork of the `scrypt` package, canonically found here:

https://www.npmjs.com/package/scrypt

With one maintainer, Barry Steyn, whose referenced repo is here:

https://github.com/barrysteyn/node-scrypt

Somebody would have to pick it up from a git URL, I think. (Maybe they could typosquat, but we'd have to find that first.)

Yeah it looks mostly like a copy and saw most commits are not by that user, but the user has made some commits and not being familiar with how NPM packages work too well, thought I'd drop a warning here.

I'm not a crypto guy but this change really makes me scratch my head: https://github.com/right9ctrl/node-scrypt/commit/52a1cb792bc...

That just looks like a convenience function to me. Rather than passing 1,2,4,8,16 in as the value of N, you pass in 0,1,2,3,4. Has the benefit that it's not possible to pass in a number that's not a power of 2 (which might not be valid, I don't know how scrypt works).

IIRC scrypt is only defined for powers of 2 for N.

Yes, that looks dodgy - a 64-bit 'N' being renamed 'logN', and its value changed to `1` left shifted by its prior self? I think there's a good bet that's just zeroing it out.

It's just doing 2^logN...

Which ought to be just N - but notice the argument passed in is mysteriously renamed. It may be nothing - I'm not even sure what N is here - I just agree that it looks weird.

https://github.com/barrysteyn/node-scrypt/pull/119

A funny thing is that on README.md, the `Install from source` section has this: `git clone https://github.com/barrysteyn/node-scrypt.git`.

Reply on news.ycombinator.com