Cordobo / angularx-qrcode

A fast and easy-to-use Angular QR Code Generator library with Ivy support
https://cordobo.github.io/angularx-qrcode/
MIT License
459 stars 127 forks source link

Fixed version without corrupted colors.js version released #155

Closed Cordobo closed 2 years ago

Cordobo commented 2 years ago

The underlying lib qrcode has a dependency of the lib colors.js which was corrupted on purpose by its author [1]. Read the article Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of apps by BleepingComputer.

As the author of the original qrcode dependency currently has no time to release a fixed version, I forked [2] the qrcode lib and bumped the dependency to a fixed version [3].

[1] colors.js https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

[2] The used fork is located here: https://github.com/Cordobo/node-qrcode

[3] Commit changes https://github.com/Cordobo/node-qrcode/commit/e09bcd350aa664d4ddc3699617607197d6368a32

Cordobo commented 1 year ago

This fix was reverted in angularx-qrcode 15.