At the location https://github.com/gevorg/htpasswd/blob/master/src/utils.js#L53C1-L54C45, the encryption of the salt with salt = bcrypt.genSaltSync(cost) should have a loop count of at least 10 to ensure sufficient security.