encrypted-attr

library1.1.0jsnpmunverified

A library for transparently encrypting model attributes in ORMs or standalone, using AES-256-GCM with 96-bit random nonces and 128-bit authentication tags. Version 1.1.0 is the current stable release, maintained as needed. Supports key rotation via key IDs and additional authenticated data (key id, object id) to prevent substitution attacks. Designed for Node.js ≥4.0, ESM-only? No, CommonJS-based. Differentiator: explicit security and threat models, integration with ORM hooks, and use of standard Node.js crypto.

storage security

npm install encrypted-attr

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · ENCRYPTED-ATTR

encrypted-attr

storagejavascriptv1.1.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

EncryptedAttributes

✓ const EncryptedAttributes = require('encrypted-attr')

✗ import EncryptedAttributes from 'encrypted-attr'

Package is CommonJS; ES module import is not supported.

encryptAttribute

✓ const ea = EncryptedAttributes(...); ea.encryptAttribute(objectId, value)

✗ encryptAttribute(objectId, value)

encryptAttribute is not a standalone export; must be called on an instance.

decryptAttribute

✓ const ea = EncryptedAttributes(...); ea.decryptAttribute(objectId, encryptedValue)

✗ decryptAttribute(objectId, encryptedValue)

Same as encryptAttribute; method on an EncryptedAttributes instance.

Shows stand-alone encryption and decryption of an attribute using random key and an object id for AAD.

const crypto = require('crypto'); const EncryptedAttributes = require('encrypted-attr'); // Generate a random 32-byte key and encode as base64 const key = crypto.randomBytes(32).toString('base64'); const encryptedAttributes = EncryptedAttributes(['ssn'], { keys: { k1: key }, keyId: 'k1' }); const ssn = '555-55-5555'; const encrypted = encryptedAttributes.encryptAttribute('user1', ssn); console.log('Encrypted:', encrypted); const decrypted = encryptedAttributes.decryptAttribute('user1', encrypted); console.log('Decrypted:', decrypted);

Debug

Known issues

gotchaKeys must be exactly 32 bytes (256 bits) and encoded as base64.

fix

Use crypto.randomBytes(32).toString('base64') to generate keys.

affects: >=1.0.0

gotchaThe key ID and object ID are included as additional authenticated data but are not encrypted; substitution of encrypted values across objects is prevented.

fix

Always provide a unique object ID (e.g., model ID) when encrypting/decrypting per-record attributes.

affects: >=1.0.0

gotchaDoes not encrypt keys or key IDs; protect them as sensitive credentials.

fix

Manage keys via environment variables, vault, or keychain. Never commit keys to source control.

affects: >=1.0.0

gotchaDoes not protect against compromised app host or log leaks; this is not a full security solution.

fix

Combine with secure coding practices (sanitize input, avoid logging secrets) and use transport encryption.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: key must be a string or a Buffer

Passing a key that is not a base64-encoded string or Buffer.

fix

Ensure keys are base64-encoded strings from 32 random bytes.

Error: Unsupported state or unable to authenticate data

Encrypted value has been tampered or key has changed.

fix

Use the same key that was used for encryption. If rotating keys, use key id mechanism.

TypeError: EncryptedAttributes is not a constructor

Attempting to import as ES module default import.

fix

Use const EncryptedAttributes = require('encrypted-attr');

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

cryptorequiredNode.js built-in for AES-256-GCM encryption and decryption.

Agent activity

28 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/simonratner/node-encrypted-attr ↗

packageencrypted-attr ↗

homepagehttps://github.com/simonratner/node-encrypted-attr ↗