registry / @luutuankiet/firefox-docker-mcp / 0.6.0

@luutuankiet/firefox-docker-mcp@0.6.0

Firefox MCP with auto-screenshot on every mutation tool call

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 57 file(s), 1.44 MB of source, external domains: example.com, gist.github.com, github.com, json-schema.org, mathiasbynens.be, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.w3.org

Source & flagged code

3 flagged

dist/index.jsView file

28018const path2 = await import("path"); L28019: const { execFileSync } = await import("child_process"); L28020: try {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L28018

12019* L12020: * This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a "hint" to the model. For example, this information ... L12021: */ ... L28018: const path2 = await import("path"); L28019: const { execFileSync } = await import("child_process"); L28020: try { ... L29454: try { L29455: this.injectedScript = readFileSync(path2, "utf-8"); L29456: const sizeKB = (this.injectedScript.length / 1024).toFixed(1); ... L32250: lines.push(` UUID: ${ext.uuid}`); L32251: lines.push(` Base URL: ${ext.baseURL}`); L32252: lines.push(` Manifest: v${ext.manifestVersion || "unknown"}`);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L12019

17452sourceCode = this.opts.code.process(sourceCode, sch); L17453: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L17454: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L17452

Source & flagged code

3 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code