quantum-audit v0.2.3 — Hybrid Detection, Migration Guides, and 50+ Libraries

Part of the quantum-audit series. Part 1 | Part 2 | Part 3

🌐 quantum-audit-site.vercel.app

v0.2.3 of quantum-audit is live. Here's everything that changed.

npx quantum-audit .

1. Migration suggestions per finding

The biggest request after the series launched. Previously, quantum-audit told you what was broken. Now it tells you what to do about it.

Every critical finding now includes a migration path:

[CRITICAL] ECDSA (secp256k1) — package.json
  ↳ Migration: Replace with @noble/post-quantum (Dilithium) for signatures

[CRITICAL] BLS12-381 (pairing-based) — package.json
  ↳ Migration: Pairing-based crypto broken by quantum. Monitor for PQC replacements.

[MEDIUM] SHA-256 (crypto.createHash) — src/utils/hash.js:14
  ↳ Migration: Consider SHA-3 for stronger quantum resistance

2. Hybrid detection

A question from the community after Part 1:

"How does quantum-audit handle hybrid classical-quantum systems?"

v0.2.3 now detects hybrid setups. If your project has both a quantum-vulnerable library and a post-quantum one, quantum-audit recognises you're mid-transition and reduces critical penalties by 50%:

⚡ Hybrid Mode: Post-quantum library detected (@noble/post-quantum)
   — hybrid transition in progress. Critical penalties reduced by 50%.

This means a project actively migrating gets scored fairly — not penalised as heavily as one that hasn't started.

3. Multi-layer PQC bonus

Inspired by DAC Chain's approach to quantum security — using multiple post-quantum algorithms stacked together rather than relying on a single one.

If your project uses two or more post-quantum libraries:

🔒 Multi-layer PQC detected (@noble/post-quantum + sphincs)
   — +10 bonus applied.

This rewards the most security-conscious projects and encourages defence in depth.

4. 50+ libraries in the detection database

v0.2.2 covered 20 libraries. v0.2.3 covers 50+. New additions include:

BLS signatures (Ethereum 2.0 consensus):

• @chainsafe/bls
• @noble/bls12-381
• noble-bls12-381
• mcl-wasm

BLS12-381 is pairing-based cryptography — broken by quantum computers. This is used in Ethereum's Proof of Stake consensus mechanism.

JWT libraries:

• jsonwebtoken — flags RS256/ES256 signing
• jose
• passport-jwt

New ECDSA packages:

• tiny-secp256k1
• @noble/secp256k1
• @noble/curves
• eth-sig-util

Classically broken (flagged as critical):

• md5 — broken without quantum, dangerous with it
• rainbow-sig — multivariate signature scheme broken in 2022

New safe/PQC libraries:

• ntru — lattice-based encryption
• falcon-sign — NIST alternate standard
• sphincsplus — hash-based NIST standard
• liboqs-node — Open Quantum Safe bindings

5. New CLI flags

--threshold — fail CI if score drops below a custom value:

npx quantum-audit . --threshold=70
# exits 1 if score < 70

--ignore — skip specific packages:

npx quantum-audit . --ignore=ethers,web3

--html — generate a full HTML report:

npx quantum-audit . --html
# writes quantum-audit-report.html

--csv — export findings to a spreadsheet:

npx quantum-audit . --csv
# writes quantum-audit-report.csv

6. Solidity file scanning

.sol files are now included in the source scan. Solidity contracts that import or use ECDSA libraries directly will be flagged.

Install / upgrade

npm install -g quantum-audit
# or
npx quantum-audit .

If you already have it installed:

npm update -g quantum-audit

What's next

• Part 4 — Hybrid classical-quantum systems in depth
• VS Code extension — surface findings inline while you code
• GitHub Action — publish quantum-audit as a marketplace action

Drop your v0.2.3 score in the comments. Has anything changed from your v.0.2.2 scan?