Language: TypeScript
Label: safe
CWE: CWE-331 \u2014 Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Code:
  async encryptStream(key, stream) {
    const bIv = this.getIv();
    const aes = createCipheriv('aes-256-cbc', key, bIv).setAutoPadding(true);
    let inited = false;
    return stream.pipe(aes).pipe(
      new Transform({
        transform(chunk, _, cb) {
          if (!inited) {
            inited = true;
            this.push(Buffer.concat([bIv, chunk]));
          } else {
            this.push(chunk);
          }
          cb();
        },
      }),
    );
  }