3 ms·

FYI: two vulnerabilities in elliptic, a widely used JavaScript library for elliptic curve cryptography

• some_furry 9mo ago
  The maintainer seems to have abandoned it: https://github.com/indutny/elliptic/issues https://github.com/indutny/elliptic/issues I wrote a shim library and posted it on their issue tracker: https://github.com/indutny/elliptic/issues/343 https://github.com/indutny/elliptic/issues/343 Unfortunately, adoption seems slow. I'm talking with a few people about how to move the ecosystem to something more secure like noble-curves, but it's tricky.
  • thephyber 9mo ago
    If you really feel like helping the ecosystem update, you could file issues/PRs for all of the downstream NPM modules to switch to your shim library. Remember to tell them what the problem is and how your library solves it.
    • some_furry 9mo ago
      If you click "Show more" you'll see this: https://imgur.com/a/KLI8cjL https://imgur.com/a/KLI8cjL