Entropy Backdoor in text-qrcode
Summary
GHSA-h5vj-f7r9-w564: Entropy Backdoor in text-qrcode. Affects text-qrcode versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The text-qrcode package is an npm package used for generating QR codes from text. It provides a simple and convenient way to convert text into QR codes for various purposes. However, all versions of text-qrcode contain a malicious code that compromises the security of the generated QR codes.
Vulnerability Detail
The vulnerability in text-qrcode is due to the presence of malicious code that modifies the randomBytes method in the crypto module. This modified method generates weak entropy by only producing 3 bytes of randomness instead of the required 32 bytes. The 3 bytes are then hashed to create a 32-byte value, but this value is easily guessable. The compromised entropy can have severe consequences for applications that rely on secure random numbers, such as bitcoin wallets, private keys, and encrypted messages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround for this vulnerability. Uninstalling the text-qrcode package is the only solution to mitigate the risk.
Conclusion
The text-qrcode package contains a critical vulnerability that compromises the security of generated QR codes. It is highly recommended to uninstall the package and replace any instances of generated entropy if it was used for load-bearing purposes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for text-qrcode →
FAQ
text-qrcode is an npm package used for generating QR codes from text.
The vulnerability compromises the security of generated QR codes and can have severe consequences for applications that rely on secure random numbers.
Uninstall the text-qrcode package and replace any instances of generated entropy if it was used for load-bearing purposes.
Yes, all versions of text-qrcode contain the malicious code that introduces the vulnerability.
No, uninstalling the text-qrcode package is the only solution to mitigate the risk.
