secp.verify() always equals true about noble-secp256k1 HOT 4 CLOSED

const secp = require('@noble/secp256k1');
const priv = secp.utils.randomPrivateKey();
const SHA256 = require('crypto-js/sha256');

(async () => {
  const message = JSON.stringify({
    to: "0xbeef",
    amount: parseInt(40)
  });

  const message2 = JSON.stringify({
    to: "0xdead",
    amount: parseInt(50)
  });

  // different message hashes
  const msg1Hash = SHA256(message).toString();
  const msg2Hash = SHA256(message2).toString();

  // msg is SIGNED here!
  const signatureArray = await secp.sign(msg1Hash, priv, {
    recovered: true
  });
  
  // get signature + rBit
  const signature = signatureArray[0];
  const rBit = signatureArray[1];

  // recover public key using signed message hash + sig + rBit
  const recoveredPublicKey1 = secp.recoverPublicKey("beef", signature, rBit).toString('hex');

  // verify
  // yields false
  console.log('verify', msg1Hash);
  console.log(secp.verify(signature, msg1Hash, recoveredPublicKey1));

  // verify message passed in to secp.recoverPublicKey but never signed!
  // yields true when should yield false
  console.log('verify msg2Hash but corner case!', msg2Hash);
  console.log(secp.verify(signature, "beef", recoveredPublicKey1));
  
})()

const secp = require('@noble/secp256k1');
const priv = secp.utils.randomPrivateKey();
const pub = secp.getPublicKey(priv);
const msg = 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef';
const msg2 = msg.replace(/d/g, '3');

(async () => {
  const signed = await secp.sign(msg, priv);
  console.log('verify', msg);
  console.log(secp.verify(signed, msg, pub));
  console.log('verify', msg2)
  console.log(secp.verify(signed, msg2, pub));
})()