bcryptjs
npmbcryptjsbcryptjs is a pure JavaScript implementation of the bcrypt password hashing algorithm, used in Node.js applications to hash and verify user passwords. It is present in virtually every Node.js application with user authentication. The `compare` function receives plaintext passwords submitted during login.
Checking bcryptjs
bcryptjs 2.4.3 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=bcryptjs&version=2.4.3" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "bcryptjs",
"version": "2.4.3",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
bcryptjs.compare and hash see plaintext passwords at login and registration. A hostile build can capture those passwords before the bcrypt operation runs.
Attestd monitors bcryptjs using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.