registry / @hominis/fireforge / 0.37.0

@hominis/fireforge@0.37.0

FireForge — a build tool for customizing Firefox

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit FireForge mach/build workflow installs a persistent Python resource-monitor guard into Firefox mach virtual environments and supplies a temporary PYTHONPATH fallback. This is a guarded platform-extension lifecycle mutation, not install-time execution or a confirmed malicious payload.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes a FireForge workflow that dispatches mach/build tooling.

Impact

Can alter Python behavior for affected Firefox mach virtualenv executions until overwritten or removed.

Mechanism

Writes and loads a Python import/resource-monitor shim in Firefox mach environments.

Rationale

Source inspection found no concrete credential theft, covert exfiltration, remote payload execution, or install-time malicious behavior. The persistent mach-virtualenv shim is nonetheless a real guarded platform-extension lifecycle risk and warrants a warning under the stated policy.

Evidence

package.jsondist/src/core/mach-resource-shim.jsdist/src/core/firefox-archive.jsdist/src/core/firefox-cache.jsdist/src/core/firefox-download.jsdist/bin/fireforge.jsdist/src/cli.jsdist/src/core/firefox.jsdist/src/utils/process.js

Network endpoints2

archive.mozilla.org/pub/firefox/releasesarchive.mozilla.org/pub/devedition/releases

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/src/core/mach-resource-shim.js` writes Python guard modules into discovered Firefox mach virtualenv `site-packages`.
The same shim prepends a temp `sitecustomize.py` directory to `PYTHONPATH` and monkey-patches Python imports/resource monitors.
`package.json` has a `prepare` hook, but the shipped `scripts/prepare.mjs` is absent and its ERR_MODULE_NOT_FOUND path exits successfully.

Evidence against

No `preinstall`, `install`, or `postinstall` hook is declared.
Network code is Firefox-source download logic restricted to `https://archive.mozilla.org` with SHA-256 verification.
CLI process execution uses explicit FireForge commands to run Firefox/mach tooling; no credential harvesting or exfiltration was found.
Dynamic imports in `dist/src/core/firefox-cache.js` and `dist/src/core/firefox.js` load Node filesystem/path modules, not remote code.
No AI-agent configuration paths or foreign agent-control-surface mutations were found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 300 file(s), 2.35 MB of source, external domains: archive.mozilla.org, facebook.github.io, git-scm.com, github.com, mozilla.org, python.org, www.mozilla.org, www.w3.org

Source & flagged code

2 flagged

dist/src/core/typecheck-shim.jsView file

Lines 28-68javascript

28 * (`patchLint.checkJsExtraShim` / `typecheck.extraShim`) can ADD members

29 * through TypeScript interface merging:

30 *

31 * // my-extra-shim.d.ts

32 * interface ChromeUtilsShim {

33 * someNewApi(arg: string): unknown;

34 * }

35 *

36 * (A second `declare var ChromeUtils` in the extra shim remains a

37 * duplicate-identifier error by design — merge the interface instead.)

38 * The member lists track upstream WebIDL additions per Firefox release

39 * (`dom/chrome-webidl/ChromeUtils.webidl` for ChromeUtils); when a new

40 * release adds a commonly-patched member, add a loose signature here.

41 *

42 * Notable patterns that require shimming:

43 * - `const lazy = {};` + `ChromeUtils.defineESModuleGetters(lazy, { ... })`

44 * populates `lazy` at runtime; we declare it as `Record<string, any>`.

45 * - `Services.obs`, `Services.prefs`, etc. are XPCOM service accessors.

46 * - `Ci`, `Cc`, `Cr`, `Cu` are XPCOM component shortcuts.

47 * - Browser chrome globals like `gBrowser`, `gURLBar` are common in

48 * content scripts wired via `browser.js`.

49 * - Dynamic `import("resource:-…")` / `import("chrome:-…")` under patch

50 * checkJs: imports of *patch-owned* modules resolve to their real

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/typecheck-shim.jsView on unpkg · L48

51 * sources (see `patch-lint-checkjs.ts`); everything else fails host

52 * resolution and lands on these URL ambient wildcards, keeping

53 * upstream Firefox imports pragmatically loose, same posture as globals.

54 */

55const FIREFOX_GLOBALS_SHIM = `

56declare var Services: any;

57// Extensible via interface merging from a project extra shim — see the

58// module doc comment in typecheck-shim.ts.

59interface ChromeUtilsShim {

60 defineESModuleGetters(target: any, modules: Record<string, string>): void;

61 importESModule(specifier: string): any;

62 import(specifier: string): any;

63 registerWindowActor(name: string, options: Record<string, any>): void;

64 defineModuleGetter(target: any, name: string, specifier: string): void;

65 defineLazyGetter(target: any, name: string, getter: () => any): void;

66 generateQI(interfaces: any[]): Function;

67 getClassName(obj: any, unwrap?: boolean): string;

68 isClassInfo(obj: any): boolean;

dist/src/core/firefox-cache.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hominis/fireforge@0.35.0 matchedIdentity = npm:QGhvbWluaXMvZmlyZWZvcmdl:0.35.0 similarity = 0.567 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/core/firefox-cache.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/src/core/typecheck-shim.jsView file

48* content scripts wired via `browser.js`. L49: * - Dynamic `import("resource:-…")` / `import("chrome:-…")` under patch L50: * checkJs: imports of *patch-owned* modules resolve to their real

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/typecheck-shim.jsView on unpkg · L48

dist/src/core/firefox-cache.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/core/firefox-cache.jsView on unpkg

Findings

1 High4 Medium6 Low

HighPrevious Version Dangerous Deltadist/src/core/firefox-cache.js

MediumDynamic Requiredist/src/core/typecheck-shim.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/src/core/typecheck-shim.jsView file

Lines 28-68javascript

28 * (`patchLint.checkJsExtraShim` / `typecheck.extraShim`) can ADD members

29 * through TypeScript interface merging:

30 *

31 * // my-extra-shim.d.ts

32 * interface ChromeUtilsShim {

33 * someNewApi(arg: string): unknown;

34 * }

35 *

36 * (A second `declare var ChromeUtils` in the extra shim remains a

37 * duplicate-identifier error by design — merge the interface instead.)

38 * The member lists track upstream WebIDL additions per Firefox release

39 * (`dom/chrome-webidl/ChromeUtils.webidl` for ChromeUtils); when a new

40 * release adds a commonly-patched member, add a loose signature here.

41 *

42 * Notable patterns that require shimming:

43 * - `const lazy = {};` + `ChromeUtils.defineESModuleGetters(lazy, { ... })`

44 * populates `lazy` at runtime; we declare it as `Record<string, any>`.

45 * - `Services.obs`, `Services.prefs`, etc. are XPCOM service accessors.

46 * - `Ci`, `Cc`, `Cr`, `Cu` are XPCOM component shortcuts.

47 * - Browser chrome globals like `gBrowser`, `gURLBar` are common in

48 * content scripts wired via `browser.js`.

49 * - Dynamic `import("resource:-…")` / `import("chrome:-…")` under patch

50 * checkJs: imports of *patch-owned* modules resolve to their real

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/typecheck-shim.jsView on unpkg · L48

51 * sources (see `patch-lint-checkjs.ts`); everything else fails host

52 * resolution and lands on these URL ambient wildcards, keeping

53 * upstream Firefox imports pragmatically loose, same posture as globals.

54 */

55const FIREFOX_GLOBALS_SHIM = `

56declare var Services: any;

57// Extensible via interface merging from a project extra shim — see the

58// module doc comment in typecheck-shim.ts.

59interface ChromeUtilsShim {

60 defineESModuleGetters(target: any, modules: Record<string, string>): void;

61 importESModule(specifier: string): any;

62 import(specifier: string): any;

63 registerWindowActor(name: string, options: Record<string, any>): void;

64 defineModuleGetter(target: any, name: string, specifier: string): void;

65 defineLazyGetter(target: any, name: string, getter: () => any): void;

66 generateQI(interfaces: any[]): Function;

67 getClassName(obj: any, unwrap?: boolean): string;

68 isClassInfo(obj: any): boolean;

dist/src/core/firefox-cache.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/core/firefox-cache.jsView on unpkg