bitcore
bitcore copied to clipboard
Security issue: insecure cryptography and dependencies
https://github.com/bitpay/bitcore/blob/f778e62c3bcaa6799f8be0bd870d7e3910d7e16f/packages/bitcore-lib/package.json#L43
has been long unmaintained; and had a few CVEs. I suggest doing following actions:
- replace elliptic with audited
@noble/curves
- replace scryptsy with audited
@noble/hashes
- upgrade ethers to v6, which stopped using elliptic
- remove bn.js, replace with native bigint
Thanks for the suggestions and concern. We're actively looking into and addressing this