# @paulmillr/qr@0.2.1 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:09:06.000Z
- Files reviewed: 6
- Findings: 3 low severity findings
- Report: https://security.togoder.click/npm/@paulmillr/qr
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @paulmillr/qr@0.2.1 on Oct 4, 2026. An AI review of 6 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] Potentially misleading comment and variable naming

Finding ID: `NPS-64A4A3FC50CE`

File: `dom.js:228`

The comment says 'Creates new QRCamera from frontal camera' but the code uses facingMode: 'environment' which requests the rear camera, not the front camera. This inconsistency could confuse users and may indicate careless code, but it is not a security vulnerability.

### [low] Debug logging of MediaStream object

Finding ID: `NPS-458B8B99104B`

File: `dom.js:237`

The frontalCamera function logs the entire MediaStream object to the console with console.log('TTT', stream). While not directly malicious, this could leak sensitive information about the user's camera stream (tracks, settings, device IDs) to the browser console, which could be exploited by other scripts or extensions.

### [low] debugging/logging

Finding ID: `NPS-FAE3202651DB`

File: `dom.ts`

A console.log statement ('TTT', stream) logs the MediaStream object to console. This is likely leftover debug code, not malicious, but could leak information in production environments if the stream object contains sensitive metadata.

## Files reviewed

- `dom.js` (medium): The code appears to be a legitimate DOM utility for QR code decoding from camera, with only minor concerns about debug logging and misleading comments; no malicious patterns detected.
- `decode.js` (safe): No malicious patterns detected; the code is a legitimate QR code decoder library from a known author with no data exfiltration, network requests, or suspicious behaviors.
- `decode.ts` (safe): No malicious patterns detected; the code is a legitimate QR code decoder implementation with no network, filesystem, process, or obfuscated code activities.
- `dom.ts` (safe): No malicious patterns detected; the code is a legitimate QR code scanning utility with only minor debug logging concerns.
- `index.js` (safe): Cleared by Jev triage; no further analysis needed
- `index.ts` (safe): This is a legitimate QR code generation library by Paul Miller with no malicious patterns, no network activity, no file system access, no process spawning, and no obfuscated or dynamically executed code.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology