Home
Docs
GitHub
Pricing
Blog
Log In

Run Sandworm Audit for your App

Get started
Hold on, we're currently generating a fresh version of this report
This package has been deprecated with the following message: Security update: Versions below 3.0.0 are deprecated.
Generated on May 8, 2024 via pnpm

jws 0.2.3

Implementation of JSON Web Signatures
Package summary
Share
20
issues
2
critical severity
vulnerability
1
license
1
11
high severity
vulnerability
3
license
6
meta
2
1
moderate severity
vulnerability
1
6
low severity
license
6
6
licenses
76
MIT
4
MIT/X11
2
ISC
3
other licenses
BSD
1
new BSD
1
N/A
1
Package created
16 Jan 2013
Version published
6 Nov 2013
Maintainers
7
Total deps
85
Direct deps
2
License
MIT

Issues

20

2 critical severity issues

critical
Recommendation: Upgrade to version 2.4.24 or later
via: base64url@0.0.3 & others
Recommendation: Check the package code and files for license information
via: base64url@0.0.3 & others
Collapse
Expand

11 high severity issues

high
Recommendation: Upgrade to version 3.0.0 or later
via: jws@0.2.3
Recommendation: Upgrade to version 3.0.0 or later
via: jws@0.2.3
Recommendation: Upgrade to version 2.6.0 or later
via: base64url@0.0.3 & others
Recommendation: Validate that the package complies with your license policy
via: base64url@0.0.3 & others
Recommendation: Validate that the package complies with your license policy
via: base64url@0.0.3 & others
Recommendation: Validate that the package complies with your license policy
via: base64url@0.0.3 & others
Recommendation: Validate that the package complies with your license policy
via: base64url@0.0.3 & others
Recommendation: Validate that the package complies with your license policy
via: base64url@0.0.3 & others
Recommendation: Validate that the package complies with your license policy
via: base64url@0.0.3 & others
via: jws@0.2.3
via: base64url@0.0.3 & others
Collapse
Expand

1 moderate severity issue

moderate
Recommendation: Upgrade to version 3.0.0 or later
via: base64url@0.0.3 & others
Collapse
Expand

6 low severity issues

low
Recommendation: Read and validate the license terms
via: base64url@0.0.3 & others
Recommendation: Read and validate the license terms
via: base64url@0.0.3 & others
Recommendation: Read and validate the license terms
via: base64url@0.0.3 & others
Recommendation: Read and validate the license terms
via: base64url@0.0.3 & others
Recommendation: Read and validate the license terms
via: base64url@0.0.3 & others
Recommendation: Read and validate the license terms
via: base64url@0.0.3 & others
Collapse
Expand

Licenses

MIT License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
sublicense
private-use
Cannot
hold-liable
Must
include-copyright
include-license
76 Packages, Including:
array-buffer-byte-length@1.0.1
arraybuffer.prototype.slice@1.0.3
available-typed-arrays@1.0.7
base64url@0.0.3
buffer-equal@0.0.2
call-bind@1.0.7
data-view-buffer@1.0.1
data-view-byte-length@1.0.1
data-view-byte-offset@1.0.0
deep-is@0.1.4
define-data-property@1.1.4
define-properties@1.2.1
difflet@0.2.6
es-abstract@1.23.3
es-define-property@1.0.0
es-errors@1.3.0
es-object-atoms@1.0.0
es-set-tostringtag@2.0.3
es-to-primitive@1.2.1
for-each@0.3.3
function-bind@1.1.2
function.prototype.name@1.1.6
functions-have-names@1.2.3
get-intrinsic@1.2.4
get-symbol-description@1.0.2
globalthis@1.0.4
gopd@1.0.1
has-bigints@1.0.2
has-property-descriptors@1.0.2
has-proto@1.0.3
has-symbols@1.0.3
has-tostringtag@1.0.2
hasown@2.0.2
internal-slot@1.0.7
is-array-buffer@3.0.4
is-bigint@1.0.4
is-boolean-object@1.1.2
is-callable@1.2.7
is-data-view@1.0.1
is-date-object@1.0.5
is-negative-zero@2.0.3
is-number-object@1.0.7
is-regex@1.1.4
is-shared-array-buffer@1.0.3
is-string@1.0.7
is-symbol@1.0.4
is-typed-array@1.1.13
is-weakref@1.0.2
isarray@2.0.5
jwa@0.0.1

MIT/X11

Invalid
Not OSI Approved
4 Packages, Including:
bunker@0.1.2
charm@0.1.2
deep-equal@0.0.0
traverse@0.5.2

ISC License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
Cannot
hold-liable
Must
include-copyright
include-license
2 Packages, Including:
abbrev@1.1.1
slide@1.1.6

BSD

Invalid
Not OSI Approved
1 Packages, Including:
burrito@0.2.12

new BSD

Invalid
Not OSI Approved
1 Packages, Including:
runforcover@0.0.2

N/A

N/A
1 Packages, Including:
uglify-js@1.1.1
Disclaimer

This deed highlights only some of the key features and terms of the actual license. It is not a license and has no legal value. You should carefully review all of the terms and conditions of the actual license before using the licensed material.

Sandworm is not a law firm and does not provide legal services. Distributing, displaying, or linking to this deed or the license that it summarizes does not create a lawyer-client or any other relationship.

Direct Dependencies

2
All Dependencies CSV
β“˜ This is a list of jws 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.
NameVersionSizeLicenseTypeVulnerabilities
base64url0.0.388.76 kBMIT
prod
2
8
1
6
jwa0.0.14.28 kBMIT
prod
2
8
1
6

Visualizations

Frequently Asked Questions

What does jws do?

JWS or JSON Web Signatures is a popular npm package used for creating and verifying JSON Web Signatures as per the draft-ietf-jose-json-web-signature-08 specification. This comprehensive tool supports various digital signature or MAC algorithms including but not limited to HS256, RS256, PS384, ES512, and more, providing both synchronous and streaming APIs for better functionality.

How do you use jws?

JWS can be used by first installing it via npm using the command npm install jws. The package provides multiple functions for different purposes.

To sign a header and payload, you can use:

const jws = require('jws'); 

const signature = jws.sign({
  header: { alg: 'HS256' },
  payload: 'h. jon benjamin',
  secret: 'has a van',
});

To verify if a signature matches a secret or key:

const jws = require('jws'); 

const isVerified = jws.verify(signature, 'HS256', 'has a van');

To decode a JWS signature:

const jws = require('jws'); 

const decodedSignature = jws.decode(signature);

Creation of 'SignStream' and 'VerifyStream' objects is also allowed which come with their specific functions.

Convenience options and APIs for defining the algorithm is currently under development.

Where are the jws docs?

Detailed documentation for JWS can be found directly in the readme file of the package's GitHub page at the url git://github.com/brianloveswords/node-jws.git, providing a comprehensive guide on its installation and usage. This includes the available APIs, installation, usage, and the list of the supported algorithms. More functions may be added over time or with different versions, it's recommended to always check the latest documentation for updated information.