ECB mode (ARCH3113)

Key typescript.security.ecb-mode · Severity error · Category security · CWE CWE-327

Using a block cipher in ECB mode leaks plaintext patterns and is never IND-CPA secure. Use an authenticated mode with a random IV.

Incorrect

import { createCipheriv } from "crypto";

const cipher = createCipheriv("aes-256-ecb", key, null);
const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);

Correct

import { createCipheriv, randomBytes } from "crypto";

const iv = randomBytes(12);
const cipher = createCipheriv("aes-256-gcm", key, iv);
const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
const tag = cipher.getAuthTag();

Fix

Replace ECB with an authenticated mode like AES-GCM that uses a random IV/nonce per message.