Security Bugs in Critical Randomness Code, Losses over $100M

The 'random.bytes() runs but doesn't work' postmortem thread surfaced a crypto library bug where a function appeared to execute correctly but produced cryptographically broken output. The thread was blunt about consequences: one commenter estimated losses exceeding $100 million and called for criminal accountability. Whether or not that number is accurate, the underlying engineering failure is well-documented: a commit marked as 'runs' passed tests but contained a flaw in the randomness generation path that was not caught by any existing checks.

The thread also raised an unanswered question about whether the original commit was accidental or malicious. The article assumes negligence; commenters noted that assumption is not established. That ambiguity matters because it affects how you model your own supply chain risk: accidental bugs and intentional backdoors require different defenses.

This connects to the npm-scan supply chain security project also floating around HN. The pattern is consistent: critical security infrastructure, especially around cryptography and randomness, is failing in ways that are hard to detect and expensive to discover after the fact.