registry / @mozilla/firefox-devtools-mcp-moz / 0.9.12

@mozilla/firefox-devtools-mcp-moz@0.9.12

Model Context Protocol (MCP) server for Firefox DevTools automation (moz build with privileged context support)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 1.27 MB of source, external domains: dotenvx.com, example.com, github.com, iana.org, json-schema.org, mozilla.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.mozilla.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

6 flagged

scripts/publish-moz-package.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Builds and publishes the firefox-devtools-mcp-moz package.

4 * Creates a staging directory with dist.moz/ and package.moz.json as package.json,

5 * then runs npm publish from there.

6 *

7 * Any extra arguments are forwarded to npm publish, e.g.:

8 * node publish-moz-package.mjs --access public --provenance

9 */

11import { readFileSync, existsSync, cpSync, copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';

12import { execSync } from 'node:child_process';

13import { resolve, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/publish-moz-package.mjsView on unpkg · L11

14import { fileURLToPath } from 'node:url';

15import { tmpdir } from 'node:os';

17const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');

19console.log('Building moz package...');

20execSync('npm run build:moz', { cwd: root, stdio: 'inherit' });

22const mozPkg = JSON.parse(readFileSync(resolve(root, 'package.moz.json'), 'utf8'));

23const stagingDir = mkdtempSync(resolve(tmpdir(), 'firefox-devtools-mcp-moz-'));

25try {

26 for (const entry of mozPkg.files) {

27 const src = resolve(root, entry);

28 const dst = resolve(stagingDir, entry);

29 if (!existsSync(src)) {

30 console.warn(`Warning: ${entry} not found, skipping`);

31 continue;

dist.moz/index.jsView file

28255package = @mozilla/firefox-devtools-mcp-moz; repositoryIdentity = firefox-devtools-mcp; dependency = geckodriver L28255: try { L28256: const { download } = await import("geckodriver"); L28257: log("geckodriver not found in PATH or selenium cache, downloading via npm package...");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist.moz/index.jsView on unpkg · L28255

17618sourceCode = this.opts.code.process(sourceCode, sch); L17619: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L17620: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist.moz/index.jsView on unpkg · L17618

47function defaultProfileDir(firefoxPath) { L48: const base = join(homedir(), ".firefox-devtools-mcp"); L49: if (!firefoxPath) { ... L107: description: "Whether to run Firefox in headless (no UI) mode", L108: default: (process.env.FIREFOX_HEADLESS ?? "false") === "true" L109: }, ... L165: type: "string", L166: description: "Path to file where Firefox output (stdout/stderr) will be written. If not specified, output is written to ~/.firefox-devtools-mcp/output/" L167: }, ... L588: issueData, L589: data: ctx.data, L590: path: ctx.path,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist.moz/index.js

scripts/setup-mcp-config.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import readline from 'readline';

6import os from 'os';

7import { fileURLToPath }

scripts/build-mcpb.mjsView file

Lines 23-53javascript

23try {

24 cpSync(resolve(root, 'dist'), resolve(stagingDir, 'dist'), { recursive: true });

25 for (const file of ['README.md', 'LICENSE-MIT', 'LICENSE-APACHE', 'package.json', 'package-lock.json']) {

Source & flagged code

6 flagged · loading source

scripts/publish-moz-package.mjsView file

11import { readFileSync, existsSync, cpSync, copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'; L12: import { execSync } from 'node:child_process'; L13: import { resolve, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/publish-moz-package.mjsView on unpkg · L11

dist.moz/index.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist.moz/index.jsView on unpkg · L28255

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist.moz/index.jsView on unpkg · L17618

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist.moz/index.jsView on unpkg · L47

scripts/setup-mcp-config.jsView file

7Cross-file remote execution chain: scripts/setup-mcp-config.js spawns dist.moz/index.js; helper contains network access plus dynamic code execution. L7: import { fileURLToPath } from 'url'; L8: import { execSync } from 'child_process'; L9: L10: const __filename = fileURLToPath(import.meta.url); L11: const __dirname = path.dirname(__filename); L12: ... L14: input: process.stdin, L15: output: process.stdout, L16: }); ... L38: // Check if using nvm L39: const nvmDir = process.env.NVM_DIR; L40: if (nvmDir) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/setup-mcp-config.jsView on unpkg · L7

scripts/build-mcpb.mjsView file

43console.log('Packing .mcpb bundle...'); L44: execSync(`npx mcpb pack "${stagingDir}" "${outFile}"`, { L45: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-mcpb.mjsView on unpkg · L43

Findings

5 High3 Medium5 Low

HighChild Processscripts/publish-moz-package.mjs

HighShell

HighCopied Package Dependency Bridgedist.moz/index.js

HighCross File Remote Execution Contextscripts/setup-mcp-config.js

HighRuntime Package Installscripts/build-mcpb.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvaldist.moz/index.js

LowWeak Cryptodist.moz/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

scripts/publish-moz-package.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Builds and publishes the firefox-devtools-mcp-moz package.

4 * Creates a staging directory with dist.moz/ and package.moz.json as package.json,

5 * then runs npm publish from there.

6 *

7 * Any extra arguments are forwarded to npm publish, e.g.:

8 * node publish-moz-package.mjs --access public --provenance

9 */

11import { readFileSync, existsSync, cpSync, copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';

12import { execSync } from 'node:child_process';

13import { resolve, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/publish-moz-package.mjsView on unpkg · L11

14import { fileURLToPath } from 'node:url';

15import { tmpdir } from 'node:os';

17const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');

19console.log('Building moz package...');

20execSync('npm run build:moz', { cwd: root, stdio: 'inherit' });

22const mozPkg = JSON.parse(readFileSync(resolve(root, 'package.moz.json'), 'utf8'));

23const stagingDir = mkdtempSync(resolve(tmpdir(), 'firefox-devtools-mcp-moz-'));

25try {

26 for (const entry of mozPkg.files) {

27 const src = resolve(root, entry);

28 const dst = resolve(stagingDir, entry);

29 if (!existsSync(src)) {

30 console.warn(`Warning: ${entry} not found, skipping`);

31 continue;

dist.moz/index.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist.moz/index.jsView on unpkg · L28255

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist.moz/index.jsView on unpkg · L17618

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist.moz/index.js

scripts/setup-mcp-config.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import readline from 'readline';

6import os from 'os';

7import { fileURLToPath }

scripts/build-mcpb.mjsView file

Lines 23-53javascript

23try {

24 cpSync(resolve(root, 'dist'), resolve(stagingDir, 'dist'), { recursive: true });

25 for (const file of ['README.md', 'LICENSE-MIT', 'LICENSE-APACHE', 'package.json', 'package-lock.json']) {