So, the company I work for recently did a security scan on one of our apps, and we got a weak hash vulnerability alert from the react-native-blob-util library. After doing some research, I found that the vulnerability was being detected due to a method used to get the hash of files that were encrypted with the MD5 hash; it isn’t used to encrypt anything.

I’ve tried to explain this multiple times to our security team, but they don’t feel comfortable with the line of code being there. I know people have had this problem before, so I want to know, what did you guys do about it?

Doing some research I found some alternative libraries, but the options I’ve seen, such as react-native-fs or react-native-file-access, have this same type of method to get the MD5 hash from files, and using those libraries requires the installation of an additional networking library to download and upload files from the internet.

Is there another alternative option that I wasn’t able to find (like another library that won’t make us get a vulnerability alert due to MD5 or SHA-1 hashes), or something I can do code-side? I saw that in one issue for the rn-fetch-blob (from which blob-util is forked), someone suggested forking the library and making the necessary adjustments, but I feel like that will require more resources in the long run to maintain the library updated.

If anyone can give more insights on this, it would be greatly appreciated.