Description
The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness.
Recommendation
Update the @dfinity/auth-client package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.20.0-beta.0, < 1.0.1
- Patched version(s): 1.0.1
References
Could your website be exposed too?
SmartScanner can check your website for agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - @dfinity/identity - CVE-2024-1631
- @cat5th/key-serializer Prototype Pollution vulnerability - CVE-2024-39018
- Generation of Error Message Containing Sensitive Information in zsa - CVE-2024-37162
- Modified package published to npm, containing malware that exfiltrates private key material - CVE-2024-54134
You might also like:
See something that needs correcting? Let us knowUpdated March 21, 2026