[dylanjeffers]

Summary

Fixes #14692. The web login worker loaded scrypt-js@2.0.4 and a Buffer polyfill from cdn.jsdelivr.net with importScripts and no integrity check. If that CDN path served different code, it would see every password typed into web and desktop login.

Changes

• Web derives keys in a Vite inline worker (createKey.worker.ts) that runs @noble/hashes scrypt from the bundle. It still starts from a blob URL like the old worker, so it works the same under the desktop app's audius:// scheme.
• createAuthService on web now gets this createKey. Mobile already passes its native one.
• Common's default createKey uses noble on every platform (lazy import, so it stays out of the entry chunk). authWorker.ts and the WebWorker helper are deleted.
• The worker rejects on error and is terminated after each key. The old one never settled on an error and leaked a worker per call.

Keys are unchanged

I ran the exact scrypt.min.js and buffer.min.js files jsdelivr serves today, called the same way as the old worker, on four inputs (ASCII, the username:::password lookup form, non-ASCII plus emoji, and empty). Their outputs are pinned in hedgehogLib.test.ts, and both the sync and async noble paths match them.

One input does behave differently: a password containing an unpaired UTF-16 surrogate. The old Buffer polyfill threw on it (encodeURIComponent URIError), so those logins never worked before. They now produce a key.

Testing

• hedgehogLib.test.ts: 25/25 pass, including the existing equivalence test against @audius/hedgehog.
• vite build with prod env. The worker is an 11 KB inline chunk, and no jsdelivr string is left in the build.
• Served that build and ran the built worker in Chromium. It returned the reference keys (about 190 ms each) and made no jsdelivr requests.
• Not tested: a real login against identity, or the packaged desktop app.

packages/libs still uses @audius/hedgehog, which has the same CDN worker. Neither web nor mobile depends on libs.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5af7fd0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR