Description

Detects usage of insecure MD5 hashing function with sensitive data in JavaScript code. MD5 is cryptographically broken and should not be used for securing sensitive information as it is vulnerable to collision attacks and is considered cryptographically insecure.

Detection Strategy

• Identifies calls to MD5 hashing functions (both 'md5' and 'MD5' variants) in JavaScript code

• Validates if the MD5 function is being used with sensitive data like passwords, tokens or personally identifiable information

• Reports a vulnerability when MD5 is used to hash or encrypt sensitive information

• Considers both direct MD5 function calls and imported/aliased references to MD5

Vulnerable code example

var md5 = require('md5');

function hashPassword(password) {
    // Vulnerable: Using MD5 hash which is cryptographically broken
    const hashedPassword = md5(password);
    return hashedPassword;
}
...

✅ Secure code example

const crypto = require('crypto');

function hashPassword(password) {
    // Secure: Using SHA-256 with salt for password hashing
    const salt = crypto.randomBytes(16).toString('hex');
    const hashedPassword = crypto
        .createHash('sha256')
        .update(salt + password)...