Is this JS library using openssl genrsa -rand improperly?
I ran the command under dtruss on OSX, with it pointing to a static file. Even then, it appears to use this as an additional source of randomness to /dev/urandom.

It's distasteful and almost certainly pointless. But assuming it only mixes the data into an already cryptographically-secure source of randomness, it's not actively harmful. That said, I can only see the syscalls being made — it's possible this is not what's happening at all under the hood.