@0xtld/node-security

Lightweight Node.js security utilities: password hashing/verify, timing-safe compare, XSS detection, and safe file buffer fetch.

Install

npm i @0xtld/node-security

Quick start

import {
  // password utils
  hashPassword,
  verifyPassword,
  timingSafeCompare,
  // xss utils
  xssAttackDetection,
  validateXssAttack,
  // file/common utils
  isURL,
  isPath,
  isFileLocal,
  getFileContentBuffer,
} from '@0xtld/node-security';

// Passwords
const stored = hashPassword('secret');
verifyPassword('secret', stored); // true
timingSafeCompare('a', 'a'); // true

// XSS
const res = xssAttackDetection('<script>alert(1)</script>');
// res.isXss === true
// Throws if payload contains XSS patterns
// validateXssAttack('<img src=x onerror=alert(1)>');

// File helpers
await isFileLocal(__filename); // true
const data = await getFileContentBuffer('https://example.com');
// data: { buffer: Buffer, type: string }

API

• Password

  • hashPassword(password: string, opts?) => string
  • verifyPassword(password: string, stored: string) => boolean
  • timingSafeCompare(a: string|Buffer, b: string|Buffer) => boolean

• XSS

  • xssAttackDetection(text: string) => { isXss, patterns, severity, message }
  • validateXssAttack(payload: any) => void | throws

• Common/File

  • isURL(input: string) => boolean
  • isPath(input: string) => boolean
  • isFileLocal(path: string) => Promise<boolean>
  • getFileContentBuffer(urlOrPath: string) => Promise<{ buffer: Buffer; type: string } | null>

Scripts

npm run build      # bundle CJS/ESM + d.ts
npm test           # run jest tests
npm publish --access public

License

MIT