Firefox thinks every crate on Crates.io is infected?! False positive, I bet?

1

If I download what seems like any crate, for instance https://static.crates.io/crates/serde/serde-1.0.228.crate which I think is a pretty widely used crate, Firefox (140.12.0esr, Debian 13) says "This file contains a virus or malware." It seems 100% sure about it, it doesn't include any softening wording or anything.

Chrome allows the same downloads with no objection.

Firefox used to allow them until a couple days ago.

Is Crates compromised, or is Firefox broken?

I already vibe coded one entire replacement crate because of this; I figured it was a virus.

VirusTotal thinks it is clean: VirusTotal

But now I think it might be a browser bug, because it says EVERY crate is a virus. What's going on?

Assuming it's bogus, maybe someone knows how to report it to Mozilla?

2

Firefox (140.12.0esr, Debian 13) not having any such issue.

3

I'm using firefox flatpak 152.0.1 and don't see such reports. could it be a debian package thing?

4

In general: file a bug at https://bugzilla.mozilla.org/

That certainly is a bit weird. While there are occasionally some false positives in this detection, it certainly should not happen like that consistently for legitimate source.
I'd suggest to report it as a bug.

5

I don't have any problems with the Debian packaged Firefox ESR either.

6

Strange, why do you use a browser to download something from crates.io? For example, I use Windows for development and Windows thinks that every Rust program is malware. I simply disable the check and everything works smooth now.

7

If I want to review the source, I go there and download it. It lets me check out what is in the package before running it, or copy it to make a patched version.

I think it may be a bug to do with redirection: https://crates.io/api/v1/crates/lz4_flex/0.13.1/download gives error; but if I download it and then right click and choose "Copy Download Link", the URL changes to https://static.crates.io/crates/lz4_flex/lz4_flex-0.13.1.crate - then if I paste that in and navigate to it, it does not give the error.

Thank you! I reported it now to Mozilla, which turned out to be easier than expected with the link (didn't have to make an account after all!), so hopefully they'll get it figured out.

For now it seems like a reliable way to work around it is:

  • try to download
  • copy new download link from failed download in downloads panel
  • open a new tab
  • paste and go.
8

Might be just firefox message just being misleading.

curl -D -  https://crates.io/api/v1/crates/lz4_flex/0.13.1/download
HTTP/2 403 
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=pfjCfwaoPFD4ZgxFQjpyIGJBJrpEFo6jS%2BBlLXzRmGQ%3D\u0026sid=af571f24-03ee-46d1-9f90-ab9030c2c74c\u0026ts=1782864358"}],"max_age":3600}
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=pfjCfwaoPFD4ZgxFQjpyIGJBJrpEFo6jS%2BBlLXzRmGQ%3D&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&ts=1782864358"
content-type: application/json
via: 1.1 heroku-router, 1.1 varnish
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
server: Heroku
accept-ranges: bytes
date: Wed, 01 Jul 2026 00:05:58 GMT
x-served-by: cache-lhr-egwu1540053-LHR, cache-lhr-egll1980064-LHR
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1782864358.826557,VS0,VE270
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 277

{"errors":[{"detail":"We are unable to process your request at this time. This usually means that you are in violation of our API data access policy (https://crates.io/data-access). Please email help@crates.io and provide the request id 4d54b5c3-bc7a-8c7d-e66a-57932730e8a4"}]}