# qrcode@1.5.3 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:39:42.000Z
- Files reviewed: 37
- Findings: 2 low severity findings
- Report: https://security.togoder.click/npm/qrcode
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package qrcode@1.5.3 on Oct 4, 2026. An AI review of 37 source files produced 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [low] top-level module execution

Finding ID: `NPS-1828D62D775E`

File: `helper/to-sjis-browser.js:3`

The file executes code at import time by assigning require('./to-sjis') to the global QRCode object. While this is a common pattern for extending a library's API and no malicious behavior is evident, it does run automatically on import. The referenced local module './to-sjis' is not included in the provided snippet, so its contents could not be verified.

### [low] File system manipulation

Finding ID: `NPS-25A2633C80D3`

File: `lib/renderer/svg.js:17`

The renderToFile function writes a file to an arbitrary path provided by the caller. While this is a legitimate feature for rendering QR codes, the unrestricted path parameter could be exploited if the caller passes untrusted input, potentially allowing writing files outside the intended scope (e.g., overwriting system files or configuration). However, since this is a library function, the responsibility typically lies with the caller to sanitize paths.

## Files reviewed

- `helper/to-sjis-browser.js` (medium): The file is a small, likely benign helper that extends the global QRCode object with a local toSJIS module, but the imported module's contents could not be verified.
- `lib/renderer/svg.js` (medium): The code appears to be a legitimate SVG QR code renderer; the only concern is an unrestricted file write path, but this is a standard API design with low risk.
- `helper/to-sjis.js` (safe): No malicious patterns detected
- `lib/browser.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/can-promise.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/alignment-pattern.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/alphanumeric-data.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/bit-buffer.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/bit-matrix.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/byte-data.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/error-correction-code.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/error-correction-level.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/finder-pattern.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/format-info.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/galois-field.js` (safe): No malicious patterns detected
- `lib/core/kanji-data.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/mask-pattern.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/mode.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/numeric-data.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/polynomial.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/qrcode.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/reed-solomon-encoder.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/regex.js` (safe): No malicious patterns detected
- `lib/core/segments.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/utils.js` (safe): No malicious patterns detected; the code is a legitimate QR code utility with no network, filesystem, process execution, or obfuscation concerns.
- `lib/core/version-check.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/core/version.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/renderer/canvas.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/renderer/png.js` (safe): No malicious patterns detected
- `lib/renderer/svg-tag.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/renderer/terminal.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/renderer/terminal/terminal-small.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/renderer/terminal/terminal.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/renderer/utf8.js` (safe): No malicious patterns detected; the file is a benign QR code renderer that produces UTF-8 block-character output and optionally writes it to a user-specified file path.
- `lib/renderer/utils.js` (safe): Cleared by Jev triage; no further analysis needed
- `lib/server.js` (safe): No malicious patterns detected

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology