Executive brief
text-qrcode is a Node.js library used to generate QR codes. All versions contain malicious code that deliberately weakens cryptographic entropy generation, making security-sensitive values like cryptocurrency private keys, encryption keys, and authentication tokens predictable and easily guessable by attackers. Any application relying on this library for security-critical randomness is at severe risk of compromise.
Technical details
The vulnerability is a deliberate backdoor (CWE-506: Embedded Malicious Code) that overwrites the crypto module's randomBytes method. Instead of generating full 32-byte cryptographic-strength entropy, the backdoored version generates only 3 bytes of entropy, hashes them, and returns the result as 32 bytes. This dramatically reduces the entropy space from 2^256 to 2^24, making any cryptographic material derived from this function (private keys, session tokens, nonces) trivially guessable through brute-force. The attack requires no authentication or user interaction—the backdoor executes automatically when the module is loaded. Any generated secrets must be rotated and regenerated after removing the malicious package.
Affected products
- text-qrcode text-qrcode all versions
Timeline
- 2020-09-01: disclosed
- 2020-09-01: advisory