Registry / auth-security / node-gpg

node-gpg

JSON →
library0.2.0jsnpmunverified

node-gpg is a Node.js wrapper that provides an interface to the GnuPG (GNU Privacy Guard) command-line utility, allowing JavaScript applications to perform cryptographic operations like encryption, decryption, signing, and verification. It was last published as version 0.2.0 in February 2020 and explicitly stated as 'work in progress' at that time. The project appears to be abandoned, with no activity since early 2020. It differentiates itself by offering a promise-based API, making it suitable for async/await patterns, unlike some older GPG wrappers. However, due to its inactivity, it may not be compatible with newer Node.js versions or GnuPG releases, and it lacks active maintenance or security updates.

auth-securityserialization
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

This package is a CommonJS module published in 2020. Direct ESM `import` statements are not supported without a transpiler.

const gpg = require('node-gpg');

Individual functions like `encrypt` are exported as properties of the main CommonJS module object.

const { encrypt } = require('node-gpg');

Similar to `encrypt`, `decrypt` is a named export available from the main module object.

const { decrypt } = require('node-gpg');

Demonstrates how to use `node-gpg` to encrypt a plaintext string for a specified recipient key and then decrypt it. This requires GnuPG to be installed and a key to be present in the keyring.

const gpg = require('node-gpg'); const path = require('path'); const fs = require('fs'); // Ensure a 'test' key exists in your GPG keyring, e.g., by creating one: // gpg --full-generate-key // Use 'test' as the User ID async function encryptAndDecryptMessage() { try { const plaintext = 'This is a secret message!'; const recipientKeyId = 'test'; // Replace with a key ID from your keyring const outputEncryptedPath = path.resolve(__dirname, './encrypted_message.gpg'); const outputDecryptedPath = path.resolve(__dirname, './decrypted_message.txt'); console.log(`Encrypting: "${plaintext}" for key ID: "${recipientKeyId}"`); const encryptedData = await gpg.encrypt(recipientKeyId, plaintext); fs.writeFileSync(outputEncryptedPath, encryptedData); console.log('Encrypted data written to:', outputEncryptedPath); console.log('Decrypting the message...'); const decryptedData = await gpg.decrypt(encryptedData); fs.writeFileSync(outputDecryptedPath, decryptedData); console.log('Decrypted data written to:', outputDecryptedPath); console.log('Decrypted content:', decryptedData); console.log('\nEncryption and decryption successful!'); } catch (error) { console.error('An error occurred:', error.message); if (error.stderr) console.error('GPG stderr:', error.stderr); console.error('Ensure GnuPG is installed and configured, and the recipient key exists.'); } } encryptAndDecryptMessage();
Debug
Known footguns
breakingThe `node-gpg` package is officially marked as 'work in progress' in its README and has not been updated since February 2020. This indicates it is effectively abandoned and highly unlikely to receive further updates, bug fixes, or security patches.
gotchaThis package is a CommonJS module. Using ES module `import` syntax will result in errors unless a transpiler (like Babel) is configured to handle CommonJS modules.
gotchaThe library directly wraps the `gpg` command-line tool. It relies on the GnuPG utility being installed and correctly configured (including keyrings) on the system where the Node.js application runs. Missing or misconfigured GPG will lead to runtime errors.
gotchaAs an abandoned project, `node-gpg` may have compatibility issues with newer versions of Node.js (especially those released after 2020) or significant changes in GnuPG itself. Its promise-based API might also have subtle bugs that were never resolved.
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
0 hits · last 30 days

No traffic data recorded yet.

Resources