registry / firefox-lldb / 0.1.5

firefox-lldb@0.1.5

LLDB platform server and GDB remote stub for debugging WebAssembly running inside Firefox

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 24 file(s), 1.05 MB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 12-52json

12 ],

13 "homepage": "https://github.com/eqrion/firefox-lldb",

14 "repository": {

15 "type": "git",

16 "url": "https://github.com/eqrion/firefox-lldb.git"

17 },

18 "type": "module",

19 "license": "MPL-2.0",

20 "engines": {

21 "node": ">=20"

22 },

23 "files": [

24 "dist"

25 ],

26 "bin": {

27 "firefox-lldb": "./dist/cli/firefox-lldb.js",

28 "firefox-lldb-server": "./dist/cli/firefox-lldb-server.js",

29 "firefox-lldb-mcp": "./dist/mcp/server.js"

30 },

31 "scripts": {

32 "postinstall": "chmod +x node_modules/node-pty/prebuilds/*/spawn-helper 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "build": "tsc -p tsconfig.json && node scripts/copy-assets.mjs",

34 "prepublishOnly": "npm run build",

35 "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",

36 "format": "prettier --write .",

37 "format:check": "prettier --check .",

38 "check": "npm run typecheck && npm run format:check",

39 "test": "node --import tsx --test test/unit/*.test.ts",

40 "test:e2e": "node --import tsx --test --test-concurrency=${E2E_CONCURRENCY:-4} --test-timeout=120000 --test-reporter=./test/e2e/reporter.mjs test/e2e/*.test.mjs",

41 "launch": "node --import tsx src/cli/firefox-lldb.ts --launch --rdp-port ${RDP_PORT:-6080} ${URL:+--url $URL}",

42 "launch-server": "node --import tsx src/cli/firefox-lldb-server.ts --launch --port ${PORT:-1234} --rdp-port ${RDP_PORT:-6080} ${URL:+--url $URL}",

43 "connect": "node --import tsx src/cli/firefox-lldb-server.ts --connect --port ${PORT:-1234} --rdp-port ${RDP_PORT:-6080} ${URL:+--url $URL}",

44 "mcp": "node --import tsx src/mcp/server.ts",

45 "component:build": "cd vendor/gdbstub-component && cargo build --release --target wasm32-wasip2",

46 "component:transpile": "npx jco transpile vendor/gdbstub-component/target/wasm32-wasip2/release/firefox_lldb_gdbstub_component.wasm -o src/gdb/generated --name gdbstub --instantiation async && node scripts/patch-generated.mjs",

47 "component": "npm run component:build && npm run component:transpile",

48 "sourcemap:build": "cd vendor/source-map-dwarf-component && cargo build --release --target wasm32-wasip2",

49 "sourcemap:transpile": "npx jco transpile vendor/source-map-dwarf-component/target/wasm32-wasip2/release/firefox_lldb_source_map_component.wasm -o src/sourcemap/generated --name sourcemap --instantiation async",

50 "sourcemap": "npm run sourcemap:build && npm run sourcemap:transpile",

51 "test:rust": "cargo test --manifest-path vendor/source-map-dwarf/Cargo.toml",

52 "build:fixtures": "npm run build:fixture-simple && npm run build:fixture-oop && npm run build:fixture-parser && npm run build:fixture-ledger && npm run build:fixture-types && npm run build:fixture-heap && npm run build:fixture-trap && npm run build:fixture-sourcemap && npm run build:fixture-eh && npm run build:fixture-jspi && npm run build:fixture-large",

dist/sourcemap/generated/sourcemap.core4.wasmView file

•path = [redacted].core4.wasm kind = wasm_module sizeBytes = 346 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sourcemap/generated/sourcemap.core4.wasmView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = chmod +x node_modules/node-pty/prebuilds/*/spawn-helper 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = chmod +x node_modules/node-pty/prebuilds/*/spawn-helper 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/sourcemap/generated/sourcemap.core4.wasmView file

•path = [redacted].core4.wasm kind = wasm_module sizeBytes = 346 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sourcemap/generated/sourcemap.core4.wasmView on unpkg

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/sourcemap/generated/sourcemap.core4.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Source & flagged code

3 flagged

package.jsonView file

Lines 12-52json

12 ],

13 "homepage": "https://github.com/eqrion/firefox-lldb",

14 "repository": {

15 "type": "git",

16 "url": "https://github.com/eqrion/firefox-lldb.git"

17 },

18 "type": "module",

19 "license": "MPL-2.0",

20 "engines": {

21 "node": ">=20"

22 },

23 "files": [

24 "dist"

25 ],

26 "bin": {

27 "firefox-lldb": "./dist/cli/firefox-lldb.js",

28 "firefox-lldb-server": "./dist/cli/firefox-lldb-server.js",

29 "firefox-lldb-mcp": "./dist/mcp/server.js"

30 },

31 "scripts": {

32 "postinstall": "chmod +x node_modules/node-pty/prebuilds/*/spawn-helper 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "build": "tsc -p tsconfig.json && node scripts/copy-assets.mjs",

34 "prepublishOnly": "npm run build",

35 "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",

36 "format": "prettier --write .",

37 "format:check": "prettier --check .",

38 "check": "npm run typecheck && npm run format:check",

39 "test": "node --import tsx --test test/unit/*.test.ts",

40 "test:e2e": "node --import tsx --test --test-concurrency=${E2E_CONCURRENCY:-4} --test-timeout=120000 --test-reporter=./test/e2e/reporter.mjs test/e2e/*.test.mjs",

41 "launch": "node --import tsx src/cli/firefox-lldb.ts --launch --rdp-port ${RDP_PORT:-6080} ${URL:+--url $URL}",

42 "launch-server": "node --import tsx src/cli/firefox-lldb-server.ts --launch --port ${PORT:-1234} --rdp-port ${RDP_PORT:-6080} ${URL:+--url $URL}",

43 "connect": "node --import tsx src/cli/firefox-lldb-server.ts --connect --port ${PORT:-1234} --rdp-port ${RDP_PORT:-6080} ${URL:+--url $URL}",

44 "mcp": "node --import tsx src/mcp/server.ts",

45 "component:build": "cd vendor/gdbstub-component && cargo build --release --target wasm32-wasip2",

47 "component": "npm run component:build && npm run component:transpile",

48 "sourcemap:build": "cd vendor/source-map-dwarf-component && cargo build --release --target wasm32-wasip2",

50 "sourcemap": "npm run sourcemap:build && npm run sourcemap:transpile",

51 "test:rust": "cargo test --manifest-path vendor/source-map-dwarf/Cargo.toml",

dist/sourcemap/generated/sourcemap.core4.wasmView file

•path = [redacted].core4.wasm kind = wasm_module sizeBytes = 346 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sourcemap/generated/sourcemap.core4.wasmView on unpkg