From 4c4ab4a6fac17772681448f52983899d218458c2 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Fri, 28 Aug 2026 14:57:28 -0500
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A5=20Remove=20insecure=20Math.random(?=
 =?UTF-8?q?)=20fallback?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fallback existed because remote debugging in Chrome ran the JS
bundle in the browser's V8, where synchronous native module calls are
not supported. Remote debugging in Chrome was removed from React Native
before 0.81, the minimum version this package supports, and the
bridgeless check already made this path dead code on the new
architecture.

Removing it guarantees that crypto.getRandomValues can never silently
return predictable values from Math.random(), which is the correct
failure mode for code generating key material. If the native module is
unavailable, TurboModuleRegistry.getEnforcing throws instead.
---
 index.js | 31 -------------------------------
 1 file changed, 31 deletions(-)

diff --git a/index.js b/index.js
index ea95358..8a6bf62 100644
--- a/index.js
+++ b/index.js
@@ -4,21 +4,6 @@ const { TurboModuleRegistry } = require('react-native')
 class TypeMismatchError extends Error {}
 class QuotaExceededError extends Error {}
 
-let warned = false
-function insecureRandomValues (array) {
-  if (!warned) {
-    console.warn('Using an insecure random number generator, this should only happen when running in a debugger without support for crypto.getRandomValues')
-    warned = true
-  }
-
-  for (let i = 0, r; i < array.length; i++) {
-    if ((i & 0x03) === 0) r = Math.random() * 0x100000000
-    array[i] = (r >>> ((i & 0x03) << 3)) & 0xff
-  }
-
-  return array
-}
-
 let module = null
 /**
  * @param {number} byteLength
@@ -51,27 +36,11 @@ function getRandomValues (array) {
     return array
   }
 
-  // Calling getRandomBase64 in remote debugging mode leads to the error
-  // "Calling synchronous methods on native modules is not supported in Chrome".
-  // So in that specific case we fall back to just using Math.random().
-  if (isRemoteDebuggingInChrome()) {
-    return insecureRandomValues(array)
-  }
-
   base64Decode(getRandomBase64(array.byteLength), new Uint8Array(array.buffer, array.byteOffset, array.byteLength))
 
   return array
 }
 
-function isRemoteDebuggingInChrome () {
-  // Remote debugging in Chrome is not supported in bridgeless
-  if ('RN$Bridgeless' in global && RN$Bridgeless === true) {
-    return false
-  }
-
-  return __DEV__ && typeof global.nativeCallSyncHook === 'undefined'
-}
-
 if (typeof global.crypto !== 'object') {
   global.crypto = {}
 }