mojic

commit ba47b99bb3dd00ea07235cabf94ea6e574fbbf75
parent 58cca9fbfd16eea2db05fe7558d7b4b6a99fd447
Author: Amit Dutta <amitdutta4255@gmail.com>
Date:   Wed, 15 Apr 2026 13:38:51 +0530

Observable Timing Discrepancy in HMAC Verification (CWE-208)

Diffstat:
M
README.md
 | 
2
+-
M
bin/mojic.js
 | 
2
+-
M
lib/CipherEngine.js
 | 
7
+++++--
M
package.json
 | 
6
+++---

4 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/README.md b/README.md
@@ -1,4 +1,4 @@
-# Mojic v2.1.3
+# Mojic v2.1.4
 
 ![NPM Downloads](https://img.shields.io/npm/d18m/mojic)
 
diff --git a/bin/mojic.js b/bin/mojic.js
@@ -9,7 +9,7 @@ import { Transform } from 'stream';
 import { StringDecoder } from 'string_decoder';
 import { CipherEngine } from '../lib/CipherEngine.js';
 
-const VERSION = '2.1.3';
+const VERSION = '2.1.4';
 
 program
     .name('mojic')
diff --git a/lib/CipherEngine.js b/lib/CipherEngine.js
@@ -3,7 +3,7 @@ import { Transform } from 'stream';
 import { StringDecoder } from 'string_decoder';
 
 /**
- * MOJIC v2.1.3 CIPHER ENGINE
+ * MOJIC v2.1.4 CIPHER ENGINE
  * "Operation Ironclad"
  * * Security Upgrades:
  * - KDF: Upgraded from PBKDF2 to Scrypt (Memory-Hard, GPU-Resistant)
@@ -390,7 +390,10 @@ export class CipherEngine {
                     return;
                 }
 
-                if (footerHex !== calcDigest) {
+                const footerBuffer = Buffer.from(footerHex, 'hex');
+                const calcBuffer = Buffer.from(calcDigest, 'hex');
+
+                if (footerBuffer.length !== calcBuffer.length || !crypto.timingSafeEqual(footerBuffer, calcBuffer)) {
                     this.emit('error', new Error("FILE_TAMPERED"));
                     return;
                 }
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
-  "name": "mojic",
-  "version": "2.1.3",
+  "name": "@notamitgamer/mojic",
+  "version": "2.1.4",
   "description": "Obfuscate C source code into encrypted, password-seeded emoji streams.",
   "main": "bin/mojic.js",
   "bin": {
@@ -16,7 +16,7 @@
     "url": "git+https://github.com/notamitgamer/mojic.git"
   },
   "publishConfig": {
-    "registry": "https://registry.npmjs.org/",
+    "registry": "https://npm.pkg.github.com/",
     "access": "public"
   },
   "dependencies": {

© notamitgamer • Site Built: 2026-07-21 13:58:23 UTC • git-mirror commit: 1037f62 [view raw info]
Originally created with stagit • modified by notamitgamer
Forked from github.com/notamitgamer/git-mirror