DEV Community

Cover image for quantum-audit v0.2.3 — Hybrid Detection, Migration Guides, and 50+ Libraries
takundanashebmuchena-pixel
takundanashebmuchena-pixel

Posted on

quantum-audit v0.2.3 — Hybrid Detection, Migration Guides, and 50+ Libraries

#javascript #security #webdev #blockchain

quantum-audit v0.2.3 — Hybrid Detection, Migration Guides, and 50+ Libraries

Part of the quantum-audit series. Part 1 | Part 2 | Part 3

🌐 quantum-audit-site.vercel.app

v0.2.3 of quantum-audit is live. Here's everything that changed.

npx quantum-audit .
Enter fullscreen mode Exit fullscreen mode

1. Migration suggestions per finding

The biggest request after the series launched. Previously, quantum-audit told you what was broken. Now it tells you what to do about it.

Every critical finding now includes a migration path:

[CRITICAL] ECDSA (secp256k1) — package.json
  ↳ Migration: Replace with @noble/post-quantum (Dilithium) for signatures

[CRITICAL] BLS12-381 (pairing-based) — package.json
  ↳ Migration: Pairing-based crypto broken by quantum. Monitor for PQC replacements.

[MEDIUM] SHA-256 (crypto.createHash) — src/utils/hash.js:14
  ↳ Migration: Consider SHA-3 for stronger quantum resistance
Enter fullscreen mode Exit fullscreen mode

2. Hybrid detection

A question from the community after Part 1:

"How does quantum-audit handle hybrid classical-quantum systems?"

v0.2.3 now detects hybrid setups. If your project has both a quantum-vulnerable library and a post-quantum one, quantum-audit recognises you're mid-transition and reduces critical penalties by 50%:

⚡ Hybrid Mode: Post-quantum library detected (@noble/post-quantum)
   — hybrid transition in progress. Critical penalties reduced by 50%.
Enter fullscreen mode Exit fullscreen mode

This means a project actively migrating gets scored fairly — not penalised as heavily as one that hasn't started.

3. Multi-layer PQC bonus

Inspired by DAC Chain's approach to quantum security — using multiple post-quantum algorithms stacked together rather than relying on a single one.

If your project uses two or more post-quantum libraries:

🔒 Multi-layer PQC detected (@noble/post-quantum + sphincs)
   — +10 bonus applied.
Enter fullscreen mode Exit fullscreen mode

This rewards the most security-conscious projects and encourages defence in depth.

4. 50+ libraries in the detection database

v0.2.2 covered 20 libraries. v0.2.3 covers 50+. New additions include:

BLS signatures (Ethereum 2.0 consensus):

  • @chainsafe/bls
  • @noble/bls12-381
  • noble-bls12-381
  • mcl-wasm

BLS12-381 is pairing-based cryptography — broken by quantum computers. This is used in Ethereum's Proof of Stake consensus mechanism.

JWT libraries:

  • jsonwebtoken — flags RS256/ES256 signing
  • jose
  • passport-jwt

New ECDSA packages:

  • tiny-secp256k1
  • @noble/secp256k1
  • @noble/curves
  • eth-sig-util

Classically broken (flagged as critical):

  • md5 — broken without quantum, dangerous with it
  • rainbow-sig — multivariate signature scheme broken in 2022

New safe/PQC libraries:

  • ntru — lattice-based encryption
  • falcon-sign — NIST alternate standard
  • sphincsplus — hash-based NIST standard
  • liboqs-node — Open Quantum Safe bindings

5. New CLI flags

--threshold — fail CI if score drops below a custom value:

npx quantum-audit . --threshold=70
# exits 1 if score < 70
Enter fullscreen mode Exit fullscreen mode

--ignore — skip specific packages:

npx quantum-audit . --ignore=ethers,web3
Enter fullscreen mode Exit fullscreen mode

--html — generate a full HTML report:

npx quantum-audit . --html
# writes quantum-audit-report.html
Enter fullscreen mode Exit fullscreen mode

--csv — export findings to a spreadsheet:

npx quantum-audit . --csv
# writes quantum-audit-report.csv
Enter fullscreen mode Exit fullscreen mode

6. Solidity file scanning

.sol files are now included in the source scan. Solidity contracts that import or use ECDSA libraries directly will be flagged.

Install / upgrade 

npm install -g quantum-audit
# or
npx quantum-audit .
Enter fullscreen mode Exit fullscreen mode

If you already have it installed:

npm update -g quantum-audit
Enter fullscreen mode Exit fullscreen mode

What's next

  • Part 4 — Hybrid classical-quantum systems in depth
  • VS Code extension — surface findings inline while you code
  • GitHub Action — publish quantum-audit as a marketplace action

Drop your v0.2.3 score in the comments. Has anything changed from your v.0.2.2 scan?

Top comments (1)

Collapse
 
takundanashebmuchenapixel profile image
takundanashebmuchena-pixel •

Open for suggestions and collaborations .