double sha256.

var sha256d = require('sha256d')

var hash = sha256d().update('hello', 'ascii').digest('hex')
console.log(hash)
//9595c9df90075148eb06860365df33584b75bff782a510c6cd4883a419833d50

sha1 is no longer considered secure, and should not be used in new cryptosystems. recent attacks have been developed which weaken sha1 significantly, from 2^80 to 2^69 attempts to find a collision.

Schiener estimates that by 2021 it could cost as little at 41k usd to generate a sha1 collision.

Also, Merkle–Damgård constructions, such as the sha1 and sha2 family of algorithms also are succeptable to a length-extension attack. this means that if you know x = sha(y) you can calculate x2 = sha(y + z) without knowing y.

This may or may not be a problem in your system, but there is no harm in being belt and suspenders safe.

MIT