Description

This detector identifies the use of predictable or hardcoded salt values passed to Key Derivation Functions (KDFs) in JavaScript code that uses the Noble cryptography library. Using a static, hardcoded, or otherwise predictable salt in a KDF undermines the security of derived keys, making them susceptible to precomputation attacks (e.g., rainbow tables) and reducing the effective entropy of the derived cryptographic material.

Detection Strategy

• Scans JavaScript source files for invocations of Noble cryptography library KDF functions (e.g., `scrypt`, `pbkdf2`, `hkdf`, or similar key derivation APIs from `@noble/hashes` or related packages).

• Inspects the argument passed as the salt parameter to these KDF function calls. A vulnerability is reported when the salt value is determined to be a hardcoded literal (e.g., a string constant, byte array literal, or empty value) rather than a dynamically generated, cryptographically random value.

• A report is triggered when the salt argument resolves to a static/predictable value at the call site — for example, passing a string like `'fixed_salt'`, an empty string `''`, a fixed numeric array, or any other compile-time constant instead of a randomly generated salt (e.g., produced by `crypto.getRandomValues()` or equivalent).

Vulnerable code example

import { argon2d, argon2i, argon2id } from "@noble/hashes/argon2.js";
import { pbkdf2, pbkdf2Async } from "@noble/hashes/pbkdf2.js";
import * as kdf from "@noble/hashes/scrypt";
import { scrypt } from "@noble/hashes/scrypt.js";
import { sha256 } from "@noble/hashes/sha2.js";
import { bytesToHex } from "@noble/hashes/utils.js";

const PASSWORD_SALT = "app-static-salt-2024";...

✅ Secure code example

import { argon2d, argon2i, argon2id } from "@noble/hashes/argon2.js";
import { pbkdf2, pbkdf2Async } from "@noble/hashes/pbkdf2.js";
import * as kdf from "@noble/hashes/scrypt";
import { scrypt } from "@noble/hashes/scrypt.js";
import { sha256 } from "@noble/hashes/sha2.js";
import { bytesToHex, randomBytes } from "@noble/hashes/utils.js"; // import randomBytes for secure salt generation

export function hashPassword(password) {...