Description

This detector identifies the use of predictable or hardcoded salts in JavaScript applications using the scrypt-js library for password hashing. Predictable salts significantly weaken password security by making rainbow table attacks feasible and allowing identical passwords to produce the same hash values.

Detection Strategy

• Scans JavaScript source code for usage of the scrypt-js library or scrypt hashing functions

• Identifies function calls to scrypt-js methods that accept salt parameters

• Analyzes salt values provided to scrypt functions to determine if they are hardcoded strings, constants, or predictable patterns

• Reports vulnerabilities when scrypt functions use static salt values instead of cryptographically random salts

• Flags cases where the same salt value could be reused across different password hashing operations

Vulnerable code example

import * as scryptJs from "scrypt-js";

export function hashPassword(password) {
  const PASSWORD_SALT = Buffer.from("static-salt"); // Predictable salt - vulnerability
  const key = scryptJs.syncScrypt(
    Buffer.from(password),
    PASSWORD_SALT,
    32768, 8, 1, 32...

✅ Secure code example

import * as scryptJs from "scrypt-js";
import { randomBytes } from "node:crypto";

export function hashPassword(password) {
  const salt = randomBytes(16); // Cryptographically secure random salt
  const key = scryptJs.syncScrypt(
    Buffer.from(password.normalize("NFKC")),
    salt,...