tsscmp
npmv1.0.6Timing safe string compare using double HMAC
Not recommended for new projects
No — tsscmp should not be adopted for new projects. Last published 2963 days ago.
- ?Adoption: grade ?, Not reported by this registry.
No download data reported for this package yet.
- FMaintenance: grade F, Failing.
Last published 2963 days ago.
- AWeight: grade A, Excellent.
Zero runtime dependencies, about 8.2 KB installed.
- BSupply chain: grade B, Good.
This package has a single maintainer (bus factor of 1).
- ALicense: grade A, Excellent.
MIT — permissive, with no copyleft found in the dependency tree.
Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.
Install cost
What you actually take on by adding tsscmp to a project.
Runtime packages this one declares itself.
Distinct packages in the full runtime tree, deduplicated the way a package manager would.
Unpacked size of this package plus its entire runtime tree.
Longest resolved dependency chain below this package.
Compatibility
- Node.js
- node >=0.6.x
- Module format
- CommonJS only
- TypeScript
- No bundled types
- Install scripts
- None
Quick start
A usage example from the tsscmp README.
var timingSafeCompare = require('tsscmp');
var sessionToken = '127e6fbfe24a750e72930c';
var givenToken = '127e6fbfe24a750e72930c';
if (timingSafeCompare(sessionToken, givenToken)) {
console.log('good token');
} else {
console.log('bad token');
}tsscmp vs the alternatives
Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.
| Package | Weekly downloads | Dependents | License | Last release |
|---|---|---|---|---|
| tsscmpthis page | 0 | 1 | MIT | 8 years ago |
| @noble/hashes | 59.6M | 1 | MIT | 1 day ago |
| node-forge | 0 | 5 | (BSD-3-Clause OR GPL-2.0) | 1 day ago |
Used by
Popular packages that depend on tsscmp.
Relationship graph
Dependencies (left) and dependents (right) of tsscmp.
Release history
No releases in the last two years, typically about 2 days apart.
| Version | Published | Size | License |
|---|---|---|---|
| 1.0.6latest | 8 years ago | 8.2 KB | MIT |
| 1.0.5 | 10 years ago | — | MIT |
| 1.0.4 | 10 years ago | — | MIT |
| 1.0.2 | 10 years ago | — | MIT |
| 1.0.1 | 10 years ago | — | MIT |
| 1.0.0 | 10 years ago | — | MIT |
Overview
tsscmp is an npm package that timing safe string compare using double HMAC. It has 1 known dependents in the graph. The latest version is 1.0.6, released under the MIT license.
Who should use it
Teams working in the npm ecosystem who need timing safe string compare using double HMAC and value a focused solution.
When not to use it
Consider an alternative if you need to have first-class TypeScript types out of the box, or if a more actively-maintained option better fits your npm stack.
Pros
- Clear open-source license (MIT).
- Zero runtime dependencies — minimal footprint.
Cons
- No bundled TypeScript types (may require a separate @types package).
Auto-generated from collected registry metadata. No external claims are inferred.
Maintainers
Frequently asked questions
Should I use tsscmp?
No — tsscmp should not be adopted for new projects. Last published 2963 days ago.
How do I install tsscmp?
Run `npm install tsscmp` to add tsscmp to your npm project.
What license is tsscmp released under?
tsscmp is distributed under the MIT license.
How popular is tsscmp?
npm does not publish download counts. Within PackageGraph's crawl, 1 known packages depend on tsscmp.
Is tsscmp still maintained?
The most recent release of tsscmp (v1.0.6) was published 8 years ago.
Does tsscmp run install scripts?
No. tsscmp does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.