After reading the crypto docs more carefully, it seems this is actually expected:
If no encoding is provided, then a buffer is returned.
As the digest()
method is deprecated in favour of read()
I'd skipped over this and had assumed a default encoding would be used if none were specified.
The solution was simply hmac.setEncoding('hex')
.