Registry / auth-security / node-gpg

node-gpg

JSON →
library0.2.0jsnpmunverified

node-gpg is a Node.js wrapper that provides an interface to the GnuPG (GNU Privacy Guard) command-line utility, allowing JavaScript applications to perform cryptographic operations like encryption, decryption, signing, and verification. It was last published as version 0.2.0 in February 2020 and explicitly stated as 'work in progress' at that time. The project appears to be abandoned, with no activity since early 2020. It differentiates itself by offering a promise-based API, making it suitable for async/await patterns, unlike some older GPG wrappers. However, due to its inactivity, it may not be compatible with newer Node.js versions or GnuPG releases, and it lacks active maintenance or security updates.

npm install node-gpg
INSTALL
IMPORT
SIG · NODE-GPG
N
node-gpg
auth-securityjavascriptv0.2.0
Install
Import
Disk
Pass rate
0/ 6
Env Coverage0 / 6
glibc
1822
musl
1822
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18226 runs
build_error
glibc
node 18226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

gpg
const gpg = require('node-gpg');
import gpg from 'node-gpg';
This package is a CommonJS module published in 2020. Direct ESM `import` statements are not supported without a transpiler.
encrypt
const { encrypt } = require('node-gpg');
import { encrypt } from 'node-gpg';
Individual functions like `encrypt` are exported as properties of the main CommonJS module object.
decrypt
const { decrypt } = require('node-gpg');
import { decrypt } from 'node-gpg';
Similar to `encrypt`, `decrypt` is a named export available from the main module object.

Demonstrates how to use `node-gpg` to encrypt a plaintext string for a specified recipient key and then decrypt it. This requires GnuPG to be installed and a key to be present in the keyring.

const gpg = require('node-gpg'); const path = require('path'); const fs = require('fs'); // Ensure a 'test' key exists in your GPG keyring, e.g., by creating one: // gpg --full-generate-key // Use 'test' as the User ID async function encryptAndDecryptMessage() { try { const plaintext = 'This is a secret message!'; const recipientKeyId = 'test'; // Replace with a key ID from your keyring const outputEncryptedPath = path.resolve(__dirname, './encrypted_message.gpg'); const outputDecryptedPath = path.resolve(__dirname, './decrypted_message.txt'); console.log(`Encrypting: "${plaintext}" for key ID: "${recipientKeyId}"`); const encryptedData = await gpg.encrypt(recipientKeyId, plaintext); fs.writeFileSync(outputEncryptedPath, encryptedData); console.log('Encrypted data written to:', outputEncryptedPath); console.log('Decrypting the message...'); const decryptedData = await gpg.decrypt(encryptedData); fs.writeFileSync(outputDecryptedPath, decryptedData); console.log('Decrypted data written to:', outputDecryptedPath); console.log('Decrypted content:', decryptedData); console.log('\nEncryption and decryption successful!'); } catch (error) { console.error('An error occurred:', error.message); if (error.stderr) console.error('GPG stderr:', error.stderr); console.error('Ensure GnuPG is installed and configured, and the recipient key exists.'); } } encryptAndDecryptMessage();
Debug
Known issues
breakingThe `node-gpg` package is officially marked as 'work in progress' in its README and has not been updated since February 2020. This indicates it is effectively abandoned and highly unlikely to receive further updates, bug fixes, or security patches.
fix
Consider using alternative, actively maintained GPG wrapper libraries or directly executing GPG commands via Node.js's `child_process` module, ensuring robust error handling.
affects: >=0.2.0
gotchaThis package is a CommonJS module. Using ES module `import` syntax will result in errors unless a transpiler (like Babel) is configured to handle CommonJS modules.
fix
Always use `const gpg = require('node-gpg');` for importing the module and its functions in Node.js environments.
affects: >=0.2.0
gotchaThe library directly wraps the `gpg` command-line tool. It relies on the GnuPG utility being installed and correctly configured (including keyrings) on the system where the Node.js application runs. Missing or misconfigured GPG will lead to runtime errors.
fix
Ensure `gpg` is installed, accessible in the system's PATH, and that necessary keys are imported into the user's keyring. Test GPG functionality directly from the command line before troubleshooting `node-gpg`.
affects: >=0.2.0
gotchaAs an abandoned project, `node-gpg` may have compatibility issues with newer versions of Node.js (especially those released after 2020) or significant changes in GnuPG itself. Its promise-based API might also have subtle bugs that were never resolved.
fix
Thoroughly test `node-gpg` in your specific Node.js and GnuPG environment for critical use cases. For new projects, prioritize actively maintained alternatives to avoid future compatibility headaches.
affects: >=0.2.0
Errors
Common errors & fixes
Error: Command failed: gpg --encrypt ... gpg: encrypt failed: No public key gpg: encryption failed: No public key
The GPG command failed because it could not find a public key for the specified recipient ID in the keyring. This often happens if the recipient's key is not imported or the `recipientKeyId` is incorrect.
fix
Verify that the GPG key for the `recipientKeyId` you are using is correctly imported into your GnuPG keyring. You can list keys with `gpg --list-keys` and import them using `gpg --import <public_key_file>`.
Error: Command failed: gpg --decrypt ... gpg: decrypt failed: secret key not available
The decryption process failed because GPG could not access the necessary private key to decrypt the data. This could be due to the private key being missing, corrupted, or password-protected and the passphrase not being provided.
fix
Ensure the private key corresponding to the encrypted data's recipient is available in your GPG keyring. If the key is passphrase-protected, ensure GPG can prompt for or receive the passphrase. For automated systems, consider using `gpg-agent` or providing the passphrase securely.
Error: spawn gpg ENOENT
The Node.js process could not find the `gpg` executable in the system's PATH. This means GnuPG is either not installed or its installation directory is not included in the environment PATH.
fix
Install GnuPG on your operating system if it's not already present. Verify that the `gpg` executable is reachable from your shell by typing `which gpg` (Linux/macOS) or `where gpg` (Windows). If not found, add its installation directory to your system's PATH environment variable.
Upgrade
Version history
0.2.0latest on npm
Audit
Dependencies
GnuPG (gpg)requiredRuntime dependency; node-gpg is a wrapper around the GPG command-line tool. GPG must be installed and configured on the host system.
Agent activity
15 hits · last 30 days
node
14
OpenAI (training)
1
Resources
node-gpg — npm install node-gpg · libregistry