New macOS Data Protection Keychain for Electron and Node.js applications released

Introduction of Keychain-Store

A new package, 'keychain-store', has been released to provide secure data storage for Electron and Node.js applications running on macOS. This package integrates with the modern macOS Data Protection Keychain, offering enhanced security features compared to older Keychain APIs.

Key Security Features

The package allows developers to protect stored items using code-signing access groups, ensuring that only explicitly entitled applications can access the data. It also supports optional device-owner authentication, including Touch ID or password, for accessing sensitive information. This enhances the security posture of applications handling user data.

Modern Keychain Integration

Unlike legacy file-based Keychain implementations, this package uses the SecItem API with `kSecUseDataProtectionKeychain: true`. This approach is recommended by Apple for new development as it supports modern access groups, iCloud Keychain synchronization, and biometric access control. Items created with older APIs are not automatically compatible and require explicit migration.

Developer Implementation Details

Developers can add the package using `pnpm add keychain-store`. The API allows for opening a keychain store with configurations for authentication (e.g., `biometrics-only`), iCloud sync, and defining both immutable and mutable accounts for storing different types of data. The running Electron or Node.js host must have a valid Apple code signature for the package to function correctly.