Firefox thinks every crate on Crates.io is infected?! False positive, I bet?

1

If I download what seems like any crate, for instance https://static.crates.io/crates/serde/serde-1.0.228.crate which I think is a pretty widely used crate, Firefox (140.12.0esr, Debian 13) says "This file contains a virus or malware." It seems 100% sure about it, it doesn't include any softening wording or anything.

Chrome allows the same downloads with no objection.

Firefox used to allow them until a couple days ago.

Is Crates compromised, or is Firefox broken?

I already vibe coded one entire replacement crate because of this; I figured it was a virus.

VirusTotal thinks it is clean: VirusTotal

But now I think it might be a browser bug, because it says EVERY crate is a virus. What's going on?

Assuming it's bogus, maybe someone knows how to report it to Mozilla?

2

Firefox (140.12.0esr, Debian 13) not having any such issue.

3

I'm using firefox flatpak 152.0.1 and don't see such reports. could it be a debian package thing?

4

In general: file a bug at https://bugzilla.mozilla.org/

That certainly is a bit weird. While there are occasionally some false positives in this detection, it certainly should not happen like that consistently for legitimate source.
I'd suggest to report it as a bug.

5

I don't have any problems with the Debian packaged Firefox ESR either.