{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "text-qrcode"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:34:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being returned, but one that is easily guessable. \n\n\n## Recommendation\n\nUninstall `text-qrcode` immediately. If the module was used to generate entropy that is load bearing, all such instances of generated entropy must be replaced. This includes things like bitcoin wallets, private keys, encrypted messages, etc.",
  "id": "GHSA-h5vj-f7r9-w564",
  "modified": "2021-10-01T13:30:18Z",
  "published": "2020-09-01T21:22:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/738"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Entropy Backdoor in text-qrcode"
}