security patch 0.6.8

Author: vveerrgg

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-nsec-seedphrase",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "A comprehensive TypeScript library for Nostr key management with BIP39 seed phrases, supporting both ESM and CommonJS. Implements NIP-01, NIP-06, NIP-19, and NIP-26 with key generation, event signing, bech32 encoding/decoding, and secure cryptographic operations.",
   "type": "module",
   "main": "./dist/index.js",

package.json

@@ -96,7 +96,10 @@ export async function getSharedSecret(
   try {
     const privKeyBytes = hexToBytes(privateKey);
     // Nostr uses 32-byte x-only pubkeys; prefix with '02' for compressed format
-    const sharedPoint = secp256k1.getSharedSecret(privKeyBytes, '02' + publicKey);
+    const sharedPoint = secp256k1.getSharedSecret(
+      privKeyBytes,
+      "02" + publicKey,
+    );
     // Extract x-coordinate only (bytes 1..33), per Nostr NIP-04 convention
     const sharedX = sharedPoint.slice(1, 33);
     privKeyBytes.fill(0); // zero sensitive material

src/core/crypto.ts

@@ -434,11 +434,16 @@ export function configureHMAC(): void {
   };
 
   // Safety check: only patch if utils exists and hmacSha256Sync is a known property
-  if ('utils' in secp256k1 && typeof (secp256k1 as any).utils?.hmacSha256Sync !== 'undefined') {
+  if (
+    "utils" in secp256k1 &&
+    typeof (secp256k1 as any).utils?.hmacSha256Sync !== "undefined"
+  ) {
     (secp256k1 as any).utils.hmacSha256 = hmacFunction;
     (secp256k1 as any).utils.hmacSha256Sync = hmacSyncFunction;
   } else {
-    logger.log("secp256k1.utils.hmacSha256Sync not found; HMAC configuration skipped (library may handle HMAC internally)");
+    logger.log(
+      "secp256k1.utils.hmacSha256Sync not found; HMAC configuration skipped (library may handle HMAC internally)",
+    );
   }
 
   logger.log("Configured HMAC for secp256k1");