registry / @hominis/fireforge / 0.34.2

@hominis/fireforge@0.34.2

FireForge — a build tool for customizing Firefox

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 287 file(s), 2.17 MB of source, external domains: archive.mozilla.org, facebook.github.io, git-scm.com, github.com, mozilla.org, python.org, www.mozilla.org, www.w3.org

Source & flagged code

1 flagged

dist/src/core/typecheck-shim.jsView file

Lines 11-51javascript

11 * operator could not infer from the rule names.

12 */

13import { dirname, resolve } from 'node:path';

14import { pathExists, readText } from '../utils/fs.js';

15/** Filename used for the synthetic Firefox-globals shim source file. */

16export const SHIM_FILENAME = '__fireforge_firefox_globals.d.ts';

17/**

18 * Minimal `.d.ts` shim for Firefox privileged-scope globals.

19 *

20 * Firefox source is plain JS — no TypeScript allowed. The shim lets

21 * TS-driven type checking run without reporting "cannot find name"

22 * for the most common Mozilla APIs. Types are intentionally loose

23 * (`any`) because full Firefox type coverage is out of scope.

24 *

25 * Notable patterns that require shimming:

26 * - `const lazy = {};` + `ChromeUtils.defineESModuleGetters(lazy, { ... })`

27 * populates `lazy` at runtime; we declare it as `Record<string, any>`.

28 * - `Services.obs`, `Services.prefs`, etc. are XPCOM service accessors.

29 * - `Ci`, `Cc`, `Cr`, `Cu` are XPCOM component shortcuts.

30 * - Browser chrome globals like `gBrowser`, `gURLBar` are common in

31 * content scripts wired via `browser.js`.

32 * - Dynamic `import("resource:-…")` / `import("chrome:-…")` under patch

33 * checkJs: imports of *patch-owned* modules resolve to their real

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/typecheck-shim.jsView on unpkg · L31

34 * sources (see `patch-lint-checkjs.ts`); everything else fails host

35 * resolution and lands on these URL ambient wildcards, keeping

36 * upstream Firefox imports pragmatically loose, same posture as globals.

37 */

38const FIREFOX_GLOBALS_SHIM = `

39declare var Services: any;

40declare var ChromeUtils: {

41 defineESModuleGetters(target: any, modules: Record<string, string>): void;

42 importESModule(specifier: string): any;

43 import(specifier: string): any;

44 defineModuleGetter(target: any, name: string, specifier: string): void;

45 defineLazyGetter(target: any, name: string, getter: () => any): void;

46 generateQI(interfaces: any[]): Function;

47 getClassName(obj: any, unwrap?: boolean): string;

48 isClassInfo(obj: any): boolean;

49};

50declare var Cu: any;

51declare var Ci: any;

Source & flagged code

1 flagged · loading source

dist/src/core/typecheck-shim.jsView file

31* content scripts wired via `browser.js`. L32: * - Dynamic `import("resource:-…")` / `import("chrome:-…")` under patch L33: * checkJs: imports of *patch-owned* modules resolve to their real

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/typecheck-shim.jsView on unpkg · L31

Findings

4 Medium6 Low

MediumDynamic Requiredist/src/core/typecheck-shim.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

1 flagged

dist/src/core/typecheck-shim.jsView file

Lines 11-51javascript

11 * operator could not infer from the rule names.

12 */

13import { dirname, resolve } from 'node:path';

14import { pathExists, readText } from '../utils/fs.js';

15/** Filename used for the synthetic Firefox-globals shim source file. */

16export const SHIM_FILENAME = '__fireforge_firefox_globals.d.ts';

17/**

18 * Minimal `.d.ts` shim for Firefox privileged-scope globals.

19 *

20 * Firefox source is plain JS — no TypeScript allowed. The shim lets

21 * TS-driven type checking run without reporting "cannot find name"

22 * for the most common Mozilla APIs. Types are intentionally loose

23 * (`any`) because full Firefox type coverage is out of scope.

24 *

25 * Notable patterns that require shimming:

26 * - `const lazy = {};` + `ChromeUtils.defineESModuleGetters(lazy, { ... })`

27 * populates `lazy` at runtime; we declare it as `Record<string, any>`.

28 * - `Services.obs`, `Services.prefs`, etc. are XPCOM service accessors.

29 * - `Ci`, `Cc`, `Cr`, `Cu` are XPCOM component shortcuts.

30 * - Browser chrome globals like `gBrowser`, `gURLBar` are common in

31 * content scripts wired via `browser.js`.

32 * - Dynamic `import("resource:-…")` / `import("chrome:-…")` under patch

33 * checkJs: imports of *patch-owned* modules resolve to their real

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/core/typecheck-shim.jsView on unpkg · L31

34 * sources (see `patch-lint-checkjs.ts`); everything else fails host

35 * resolution and lands on these URL ambient wildcards, keeping

36 * upstream Firefox imports pragmatically loose, same posture as globals.

37 */

38const FIREFOX_GLOBALS_SHIM = `

39declare var Services: any;

40declare var ChromeUtils: {

41 defineESModuleGetters(target: any, modules: Record<string, string>): void;

42 importESModule(specifier: string): any;

43 import(specifier: string): any;

44 defineModuleGetter(target: any, name: string, specifier: string): void;

45 defineLazyGetter(target: any, name: string, getter: () => any): void;

46 generateQI(interfaces: any[]): Function;

47 getClassName(obj: any, unwrap?: boolean): string;

48 isClassInfo(obj: any): boolean;

49};

50declare var Cu: any;

51declare var Ci: any;