Summary
Togoder Security scanned the npm package qrcode@1.5.3 on Oct 4, 2026. An AI review of 37 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
top-level module execution
NPS-1828D62D775E
The file executes code at import time by assigning require('./to-sjis') to the global QRCode object. While this is a common pattern for extending a library's API and no malicious behavior is evident, it does run automatically on import. The referenced local module './to-sjis' is not included in the provided snippet, so its contents could not be verified.
File system manipulation
NPS-25A2633C80D3
The renderToFile function writes a file to an arbitrary path provided by the caller. While this is a legitimate feature for rendering QR codes, the unrestricted path parameter could be exploited if the caller passes untrusted input, potentially allowing writing files outside the intended scope (e.g., overwriting system files or configuration). However, since this is a library function, the responsibility typically lies with the caller to sanitize paths.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| helper/to-sjis-browser.js | medium | The file is a small, likely benign helper that extends the global QRCode object with a local toSJIS module, but the imported module's contents could not be verified. |
| lib/renderer/svg.js | medium | The code appears to be a legitimate SVG QR code renderer; the only concern is an unrestricted file write path, but this is a standard API design with low risk. |
| helper/to-sjis.js | safe | No malicious patterns detected |
| lib/browser.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/can-promise.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/alignment-pattern.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/alphanumeric-data.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/bit-buffer.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/bit-matrix.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/byte-data.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/error-correction-code.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/error-correction-level.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/finder-pattern.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/format-info.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/galois-field.js | safe | No malicious patterns detected |
| lib/core/kanji-data.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/mask-pattern.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/mode.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/numeric-data.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/polynomial.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/qrcode.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/reed-solomon-encoder.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/regex.js | safe | No malicious patterns detected |
| lib/core/segments.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/utils.js | safe | No malicious patterns detected; the code is a legitimate QR code utility with no network, filesystem, process execution, or obfuscation concerns. |
Show 12 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| lib/core/version-check.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/core/version.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/index.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/renderer/canvas.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/renderer/png.js | safe | No malicious patterns detected |
| lib/renderer/svg-tag.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/renderer/terminal.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/renderer/terminal/terminal-small.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/renderer/terminal/terminal.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/renderer/utf8.js | safe | No malicious patterns detected; the file is a benign QR code renderer that produces UTF-8 block-character output and optionally writes it to a user-specified file path. |
| lib/renderer/utils.js | safe | Cleared by Jev triage; no further analysis needed |
| lib/server.js | safe | No malicious patterns detected |
Scanned versions of qrcode
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 1.5.3 | Needs review | 37 | Oct 4, 2026 |
Frequently asked questions
Is qrcode safe to use?
No confirmed malware was found in qrcode@1.5.3, but the review flagged 2 low severity findings for risky patterns worth checking before you rely on it.
Does qrcode contain malware?
No malware was identified in qrcode@1.5.3 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was qrcode checked?
Togoder Security downloaded the published npm package and had an AI model read its 37 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan qrcode together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in qrcode@1.5.3, cost nothing.