Fix for timing attacks on MAC verification.
add repository property to package.json