registry  /  @mdn/fred  /  2.7.0

@mdn/fred@2.7.0

MDN's next fr(ont)e(n)d.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Manifest
CopyleftLicense
scanned 1,355 file(s), 10.7 MB of source, external domains: api.github.com, avatars.githubusercontent.com, bcd.developer.mozilla.org, bsky.app, debug-ping-preview.firebaseapp.com, developer.mozilla.org, example.com, fb.me, firefox-source-docs.mozilla.org, github.com, hacks.mozilla.org, incoming.telemetry.mozilla.org, interactive-examples.mdn.mozilla.net, js.stripe.com, lit.dev, live-samples.mdn.mozilla.net, mastodon.social, mdn.github.io, mozilla.github.io, mozillausercontent.com, observatory-api.mdn.mozilla.net, platform.openai.com, projectfluent.org, react.dev, robdodson.me, schema.org, scrimba.com, support.mozilla.org, survey.alchemer.com, tinyurl.com, updates.developer.mozilla.org, v2.scrimba.com, webplatform.github.io, www.buysellads.com, www.mozilla.org, www.w3.org, x.com

Source & flagged code

9 flagged · loading source
build/localhost-privkey.pemView file
1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----
Critical
Critical Secret

Package contains a critical-looking secret pattern.

build/localhost-privkey.pemView on unpkg · L1
1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----
Critical
Secret Pattern

RSA private key in build/localhost-privkey.pem

build/localhost-privkey.pemView on unpkg · L1
out/static/legacy/6753.ac0e5c0234afbe15.jsView file
16<slot @update=${this._onEditorUpdate} @console=${this._onConsole}></slot> L17: `}};customElements.define("play-controller",PlayController);let a=(0,n.a)({tagName:"play-controller",elementClass:PlayController,react:o})},88038(t,e,s){let r,n,o;s.d(e,{c:()=>Play... L18: class=${this.minimal?"editor minimal":"editor"}
High
Child Process

Package source references child process execution.

out/static/legacy/6753.ac0e5c0234afbe15.jsView on unpkg · L16
out/static/legacy/prism-java-js.b365abbc462220fa.jsView file
1export const __rspack_esm_id="8390";export const __rspack_esm_ids=["8390"];export const __webpack_modules__={96976(){var e,s,t,n;e=Prism,s=/\b(?:abstract|assert|boolean|break|byte|... L2: //# sourceMappingURL=prism-java-js.b365abbc462220fa.js.map
Medium
Dynamic Require

Package source references dynamic require/import behavior.

out/static/legacy/prism-java-js.b365abbc462220fa.jsView on unpkg · L1
out/static/ssr/index.jsView file
1769</section> L1770: </div>`}};customElements.define("mdn-placement-top",MDNPlacementTop)},20126(t,r,s){let a;s.d(r,{M:()=>c});var n=s(77278),o=s(45742);let l={side:{typ:"side",renderer:/Doc|BlogPost|C... L1771: <ul aria-live="polite"> ... L1780: <slot @update=${this._onEditorUpdate} @console=${this._onConsole}></slot> L1781: `}};customElements.define("mdn-play-controller",MDNPlayController)},51836(t,r,s){let a,n,o;s.d(r,{t:()=>MDNPlayEditor});let l=[],c=[],d="lc,34,7n,7,7b,19,,,,2,,2,,,20,b,1c,l,g,,2t,... L1782: class=${this.minimal?"editor minimal":"editor"}
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

out/static/ssr/index.jsView on unpkg · L1769
scripts/tests.jsView file
29try { L30: execSync(`npx lefthook run --force pre-push`, { stdio: "inherit" }); L31: } catch {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/tests.jsView on unpkg · L29
out/static/legacy/watify_bg.e3ab88fab7f71ec6.wasmView file
•path = out/static/legacy/watify_bg.e3ab88fab7f71ec6.wasm kind = wasm_module sizeBytes = 754972 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

out/static/legacy/watify_bg.e3ab88fab7f71ec6.wasmView on unpkg
components/font/fonts/subset.shView file
•path = components/font/fonts/subset.sh kind = build_helper sizeBytes = 676 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

components/font/fonts/subset.shView on unpkg
out/static/legacy/BarlowCondensed-SemiBold.199288b668a15dc1.woff2View file
•path = [redacted]-SemiBold.199288b668a15dc1.woff2 kind = high_entropy_blob sizeBytes = 60508 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

out/static/legacy/BarlowCondensed-SemiBold.199288b668a15dc1.woff2View on unpkg

Findings

2 Critical5 High6 Medium7 Low
CriticalCritical Secretbuild/localhost-privkey.pem
CriticalSecret Patternbuild/localhost-privkey.pem
HighChild Processout/static/legacy/6753.ac0e5c0234afbe15.js
HighShell
HighSame File Env Network Executionout/static/ssr/index.js
HighRuntime Package Installscripts/tests.js
HighShips High Entropy Blobout/static/legacy/BarlowCondensed-SemiBold.199288b668a15dc1.woff2
MediumDynamic Requireout/static/legacy/prism-java-js.b365abbc462220fa.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleout/static/legacy/watify_bg.e3ab88fab7f71ec6.wasm
MediumShips Build Helpercomponents/font/fonts/subset.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowCopyleft License