Please mark as deprecated with npm deprecate

[toddself]

Just auditing our software and see that we're using this library. If you mark is a deprecated in NPM users will receive a deprecation error when installing. (It will still install though)

https://docs.npmjs.com/cli/deprecate

[toastedcornflakes]

Agree. This still shows up as #1 result when googling 'hash password nodejs'.

Using SHA1 as default hash for password is not good practice.