{"id":11154,"library":"js-md4","title":"js-md4: MD4 Hash Function","description":"js-md4 is a JavaScript library providing a pure JavaScript implementation of the MD4 cryptographic hash function. Currently at version 0.3.2, its last known release was over eight years ago, indicating it is an abandoned project with no ongoing maintenance or updates. The library supports UTF-8 encoding for input strings and can process various data types, including JavaScript strings, raw byte `Array`s, `Uint8Array`s, and `ArrayBuffer`s. It offers both a direct hashing function for immediate results and an incremental hashing API via a `create()` method, allowing for data to be fed in chunks. Output formats include hexadecimal strings, byte arrays, and ArrayBuffers. Key differentiators at the time of its release were its pure JavaScript nature, broad browser compatibility (via script tag and AMD), and Node.js support (via CommonJS). Given the long period of inactivity and the known cryptographic weaknesses of MD4 itself, this library is primarily suitable for compatibility with legacy systems or non-security-critical hashing tasks.","status":"abandoned","version":"0.3.2","language":"javascript","source_language":"en","source_url":"https://github.com/emn178/js-md4","tags":["javascript","md4","hash","encryption","cryptography","HMAC"],"install":[{"cmd":"npm install js-md4","lang":"bash","label":"npm"},{"cmd":"yarn add js-md4","lang":"bash","label":"yarn"},{"cmd":"pnpm add js-md4","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"For Node.js, use CommonJS `require`. This library does not provide an ESM export.","wrong":"import md4 from 'js-md4';","symbol":"md4","correct":"var md4 = require('js-md4');"},{"note":"In a browser environment, the `md4` function is exposed globally after including the script.","symbol":"md4","correct":"<script src=\"path/to/md4.min.js\"></script>\n// md4 is now global"},{"note":"Used for incremental hashing, allowing data to be updated in multiple steps before finalizing the hash.","symbol":"md4.create","correct":"var hash = md4.create();"}],"quickstart":{"code":"const md4 = require('js-md4');\n\n// Basic one-shot hashing\nconst hash1 = md4('Message to hash');\nconsole.log(`Direct hash: ${hash1}`);\n\n// Hashing with specific output format (hexadecimal is default for direct string input)\nconst hash2Hex = md4.hex('Another message');\nconsole.log(`Hex output: ${hash2Hex}`);\n\nconst hash3Array = md4.array('Bytes output');\nconsole.log(`Array output: ${hash3Array}`);\n\n// Incremental hashing\nconst hasher = md4.create();\nhasher.update('Part one of ');\nhasher.update('the message');\nconst finalHash = hasher.hex();\nconsole.log(`Incremental hash: ${finalHash}`);\n\n// Hashing a UTF-8 string\nconst utf8Hash = md4('你好世界');\nconsole.log(`UTF-8 hash: ${utf8Hash}`);","lang":"javascript","description":"Demonstrates both direct and incremental MD4 hashing with various input and output types, including UTF-8 strings."},"warnings":[{"fix":"Migrate to a cryptographically secure hash function such as SHA-256 or SHA-3 (e.g., using Node.js's `crypto` module or a modern library like `noble-hashes`).","message":"The MD4 hash algorithm is cryptographically broken and should never be used for security-sensitive applications like password hashing, digital signatures, or integrity checks where collision resistance is required. It is vulnerable to collision attacks.","severity":"breaking","affected_versions":">=0.1.0"},{"fix":"Use `arrayBuffer()` instead of `buffer()` to retrieve the hash as an ArrayBuffer.","message":"The `buffer()` method is deprecated due to potential confusion with Node.js's `Buffer` object. Although it might still function, its use is discouraged.","severity":"deprecated","affected_versions":">=0.3.0"},{"fix":"For new projects, avoid this library entirely. For existing projects, evaluate the risk of using unmaintained code and consider replacing it with a current alternative, especially if MD4 is used for non-cryptographic purposes that require ongoing reliability.","message":"This library is abandoned and has not been updated in over eight years (last release 0.3.2). It does not receive security patches, bug fixes, or feature enhancements, posing a potential supply chain security risk.","severity":"gotcha","affected_versions":">=0.3.2"},{"fix":"For ESM projects, use a bundler (e.g., Webpack, Rollup, Parcel) that can handle CommonJS modules, or continue to use `require()` in Node.js where appropriate.","message":"The library primarily targets CommonJS for Node.js and global/AMD for browsers. It does not provide native ES Module (ESM) exports, which may require bundling or specific loader configurations in modern JavaScript environments.","severity":"gotcha","affected_versions":">=0.1.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"In browsers, ensure `<script src=\"path/to/md4.min.js\"></script>` is included. In Node.js, use `const md4 = require('js-md4');`.","cause":"Attempting to use `md4` in a browser without including the script, or in a Node.js ESM context without proper CommonJS import.","error":"md4 is not defined"},{"fix":"Replace `hash.buffer()` with `hash.arrayBuffer()`.","cause":"Calling the deprecated `buffer()` method on an `md4` hash instance.","error":"TypeError: md4.buffer is not a function"},{"fix":"For browsers, use the global `md4` object after loading the script via a `<script>` tag. For ESM in Node.js, this library is not directly compatible; consider a bundler or an alternative library.","cause":"Attempting to use `require('js-md4')` in a browser environment or in an ES Module context in Node.js without a transpiler/bundler.","error":"ReferenceError: require is not defined"}],"ecosystem":"npm"}