registry / @mozilla/firefox-devtools-mcp-moz / 0.9.9

@mozilla/firefox-devtools-mcp-moz@0.9.9

Model Context Protocol (MCP) server for Firefox DevTools automation (moz build with privileged context support)

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 1.26 MB of source, external domains: dotenvx.com, example.com, github.com, iana.org, json-schema.org, mozilla.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.mozilla.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

4 flagged

scripts/publish-moz-package.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Builds and publishes the firefox-devtools-mcp-moz package.

4 * Creates a staging directory with dist.moz/ and package.moz.json as package.json,

5 * then runs npm publish from there.

6 *

7 * Any extra arguments are forwarded to npm publish, e.g.:

8 * node publish-moz-package.mjs --access public --provenance

9 */

11import { readFileSync, existsSync, cpSync, copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';

12import { execSync } from 'node:child_process';

13import { resolve, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/publish-moz-package.mjsView on unpkg · L11

14import { fileURLToPath } from 'node:url';

15import { tmpdir } from 'node:os';

17const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');

19console.log('Building moz package...');

20execSync('npm run build:moz', { cwd: root, stdio: 'inherit' });

22const mozPkg = JSON.parse(readFileSync(resolve(root, 'package.moz.json'), 'utf8'));

23const stagingDir = mkdtempSync(resolve(tmpdir(), 'firefox-devtools-mcp-moz-'));

25try {

26 for (const entry of mozPkg.files) {

27 const src = resolve(root, entry);

28 const dst = resolve(stagingDir, entry);

29 if (!existsSync(src)) {

30 console.warn(`Warning: ${entry} not found, skipping`);

31 continue;

dist.moz/index.jsView file

28239package = @mozilla/firefox-devtools-mcp-moz; repositoryIdentity = firefox-devtools-mcp; dependency = geckodriver L28239: try { L28240: const { download } = await import("geckodriver"); L28241: log("geckodriver not found in PATH or selenium cache, downloading via npm package...");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist.moz/index.jsView on unpkg · L28239

17602sourceCode = this.opts.code.process(sourceCode, sch); L17603: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L17604: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist.moz/index.jsView on unpkg · L17602

scripts/setup-mcp-config.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import readline from 'readline';

6import os from 'os';

7import { fileURLToPath } from

Source & flagged code

4 flagged · loading source

scripts/publish-moz-package.mjsView file

11import { readFileSync, existsSync, cpSync, copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'; L12: import { execSync } from 'node:child_process'; L13: import { resolve, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/publish-moz-package.mjsView on unpkg · L11

dist.moz/index.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist.moz/index.jsView on unpkg · L28239

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist.moz/index.jsView on unpkg · L17602

scripts/setup-mcp-config.jsView file

7Cross-file remote execution chain: scripts/setup-mcp-config.js spawns dist.moz/index.js; helper contains network access plus dynamic code execution. L7: import { fileURLToPath } from 'url'; L8: import { execSync } from 'child_process'; L9: L10: const __filename = fileURLToPath(import.meta.url); L11: const __dirname = path.dirname(__filename); L12: ... L14: input: process.stdin, L15: output: process.stdout, L16: }); ... L38: // Check if using nvm L39: const nvmDir = process.env.NVM_DIR; L40: if (nvmDir) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/setup-mcp-config.jsView on unpkg · L7

Findings

4 High3 Medium4 Low

HighChild Processscripts/publish-moz-package.mjs

HighShell

HighCopied Package Dependency Bridgedist.moz/index.js

HighCross File Remote Execution Contextscripts/setup-mcp-config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvaldist.moz/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

scripts/publish-moz-package.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Builds and publishes the firefox-devtools-mcp-moz package.

4 * Creates a staging directory with dist.moz/ and package.moz.json as package.json,

5 * then runs npm publish from there.

6 *

7 * Any extra arguments are forwarded to npm publish, e.g.:

8 * node publish-moz-package.mjs --access public --provenance

9 */

11import { readFileSync, existsSync, cpSync, copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';

12import { execSync } from 'node:child_process';

13import { resolve, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

scripts/publish-moz-package.mjsView on unpkg · L11

14import { fileURLToPath } from 'node:url';

15import { tmpdir } from 'node:os';

17const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');

19console.log('Building moz package...');

20execSync('npm run build:moz', { cwd: root, stdio: 'inherit' });

22const mozPkg = JSON.parse(readFileSync(resolve(root, 'package.moz.json'), 'utf8'));

23const stagingDir = mkdtempSync(resolve(tmpdir(), 'firefox-devtools-mcp-moz-'));

25try {

26 for (const entry of mozPkg.files) {

27 const src = resolve(root, entry);

28 const dst = resolve(stagingDir, entry);

29 if (!existsSync(src)) {

30 console.warn(`Warning: ${entry} not found, skipping`);

31 continue;

dist.moz/index.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist.moz/index.jsView on unpkg · L28239

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist.moz/index.jsView on unpkg · L17602

scripts/setup-mcp-config.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import readline from 'readline';

6import os from 'os';

7import { fileURLToPath } from