SEC2-052: postulo-firefox's development chain locks web-ext 8.10.0 with fifteen open advisories (three critical), and CI runs no `npm audit` #9

New issue

Closed

opened 2026-10-17 10:39:34 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-17 10:39:34 +00:00

Owner

Found on 2026-10-16 in a read-only security review of postulo-firefox at c9ee306, checked by a second, independent pass.

Severity: Low · Category: Dependencies · Reference: CWE-1104 (Use of Unmaintained Third Party Components); OWASP A06:2021 (Vulnerable and Outdated Components)

Location:

package.json:16-17 ("web-ext": "^8.0.0"), package-lock.json (node_modules/web-ext at 8.10.0)
.forgejo/workflows/ci.yml:15-25 and .forgejo/workflows/release.yml:25-33 (npm ci … npx web-ext lint … npx web-ext build; no audit step)

Issue

An npm audit run on 2026-10-16 against package-lock.json reports 15 advisories (3 critical, 8 high, 4 moderate), in the same web-ext 8.x tree as the Chromium extension (shell-quote, fx-runner critical) plus brace-expansion and fast-uri. npm run sign (web-ext sign --channel unlisted) runs this chain with the AMO credentials in its environment, which is the one place a compromised development dependency in this repository would reach something that matters beyond the contributor's machine. Neither workflow audits.

Impact

Development-time only for lint, build and run; sign hands the chain the signing credentials. No shipped bytes come from these packages.

Fix

npm install --save-dev web-ext@^10.8.0 && npm audit fix (web-ext 10 needs Node >= 20), diff the built package against the current one once, and add npm audit --audit-level=high after npm ci in both ci.yml and release.yml. Done when: npm audit is clean and both workflows fail on a new high advisory.

postulo/postulo-chromium SEC2-051 - the same chain in the Chromium extension. #1 (closed) - CI artifact action and reproducible builds, not the audit.

Found on 2026-10-16 in a read-only security review of `postulo-firefox` at `c9ee306`, checked by a second, independent pass. **Severity:** Low · **Category:** Dependencies · **Reference:** CWE-1104 (Use of Unmaintained Third Party Components); OWASP A06:2021 (Vulnerable and Outdated Components) **Location:** - `package.json:16-17` (`"web-ext": "^8.0.0"`), `package-lock.json` (`node_modules/web-ext` at `8.10.0`) - `.forgejo/workflows/ci.yml:15-25` and `.forgejo/workflows/release.yml:25-33` (`npm ci` … `npx web-ext lint` … `npx web-ext build`; no audit step) ## Issue An `npm audit` run on 2026-10-16 against `package-lock.json` reports 15 advisories (3 critical, 8 high, 4 moderate), in the same `web-ext` 8.x tree as the Chromium extension (`shell-quote`, `fx-runner` critical) plus `brace-expansion` and `fast-uri`. `npm run sign` (`web-ext sign --channel unlisted`) runs this chain with the AMO credentials in its environment, which is the one place a compromised development dependency in this repository would reach something that matters beyond the contributor's machine. Neither workflow audits. ## Impact Development-time only for `lint`, `build` and `run`; `sign` hands the chain the signing credentials. No shipped bytes come from these packages. ## Fix `npm install --save-dev web-ext@^10.8.0 && npm audit fix` (web-ext 10 needs Node >= 20), diff the built package against the current one once, and add `npm audit --audit-level=high` after `npm ci` in both `ci.yml` and `release.yml`. Done when: `npm audit` is clean and both workflows fail on a new high advisory. ## Related postulo/postulo-chromium SEC2-051 - the same chain in the Chromium extension. #1 (closed) - CI artifact action and reproducible builds, not the audit.

tiagoagueda added the

bug

security

labels

2026-10-17 10:39:35 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a commit

2026-10-19 07:05:10 +00:00

Move the development chain to web-ext 10.8, audit it in CI, keep the token out of .git/config

tiagoagueda referenced this issue from a pull request that will close it,