@totemsdk/core 1.2.2 → 1.2.4

package/dist/bip39.js

@@ -402,16 +402,23 @@ function phraseToSeed(rawPhrase) {
  * @returns Array of 24 random BIP39 words (lowercase)
  */
 function generateWordList() {
-    const words = [];
     const randomValues = new Uint32Array(24);
     if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
         crypto.getRandomValues(randomValues);
     }
-    else {
+    else if (typeof process !== 'undefined' && process.versions?.node) {
+        const nodeCrypto = Function('return require')()('crypto');
+        const bytes = nodeCrypto.randomBytes(96);
         for (let i = 0; i < 24; i++) {
-            randomValues[i] = Math.floor(Math.random() * 0x100000000);
+            randomValues[i] = bytes.readUInt32BE(i * 4);
         }
     }
+    else {
+        throw new Error('generateWordList: no cryptographically secure random source available. ' +
+            'Seed generation requires crypto.getRandomValues (browser/Node 19+) or node:crypto.randomBytes (Node). ' +
+            'Math.random() is not acceptable for key material.');
+    }
+    const words = [];
     for (let i = 0; i < 24; i++) {
         const index = randomValues[i] % exports.WORD_LIST.length;
         words.push(exports.WORD_LIST[index]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totemsdk/core",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "Core cryptographic primitives for Totem SDK — backed by Rust/WASM",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",