[@module-federation/bridge-react-webpack-plugin] Test fixture package.json files shipped in npm tarball trigger false-positive CVE blocks in security scanners

[rica000]

Summary

The published npm tarball for @module-federation/bridge-react-webpack-plugin@2.3.2 (and likely prior versions) includes test fixture package.json files from __tests__/mockRouterDir/. Security scanners (e.g. JFrog Xray, Snyk) scan every package.json inside a tarball and treat these mock stubs as real installed packages. This causes the entire tarball to be blocked from download by any organization with a CVE-blocking policy, completely breaking pnpm install / npm install in CI/CD.

---

Reproduction

curl -s https://registry.npmjs.org/@module-federation/bridge-react-webpack-plugin/-/bridge-react-webpack-plugin-2.3.2.tgz | tar -tzf - | grep package.json

Output:

package/__tests__/mockRouterDir/router-v5/react-router-dom/package.json
package/__tests__/mockRouterDir/router-v6/react-router-dom/package.json
package/__tests__/mockRouterDir/router-v7/react-router/package.json
package/package.json

The file package/__tests__/mockRouterDir/router-v7/react-router/package.json declares:

{
  "name": "react-router",
  "version": "7.0.0"
}

This is a mock stub used by the test suite to simulate router v7. It is not a real dependency — the real root package.json has no react-router dependency at all. However, JFrog Xray (and similar scanners) find this file inside the tarball and flag it with all CVEs affecting react-router@7.0.0.

---

Impact

With a CVE-blocking download policy enabled (common in enterprise environments), JFrog Xray returns a hard HTTP 403 on the tarball:

ERR_PNPM_FETCH_403  GET .../bridge-react-webpack-plugin-2.3.2.tgz: 403

npm-notice: Artifact download request rejected: bridge-react-webpack-plugin-2.3.2.tgz
was not downloaded due to the download blocking policy configured in Xray
X-Artifactory-Xray-Origin: true

The 6 CVEs in react-router@7.0.0 that trigger the block (all fixed in ≥7.12.0):

CVE	Severity	Fixed In
CVE-2025-43865	HIGH	7.5.2
CVE-2025-59057	HIGH	7.9.0
CVE-2026-21884	HIGH	7.12.0
CVE-2025-68470	MEDIUM	7.9.6
CVE-2026-22029	MEDIUM	7.12.0
CVE-2026-22030	MEDIUM	7.12.0

This completely breaks CI/CD pipelines — pnpm install exits with code 1 and the build cannot proceed. The pnpm.overrides workaround ("react-router": ">=7.13.0") does not help because Xray blocks the tarball before pnpm can even download it — the override never gets a chance to apply.

Note: This is distinct from issue #4474 which described react-router as an actual runtime dependency. In this package, react-router is not a real dependency at all — the block is a false positive caused solely by test fixtures being included in the published tarball.

---

Root Cause

The package.json for this package has no files field and no .npmignore, so npm publishes the entire project directory including __tests__/:

// packages/bridge/bridge-react-webpack-plugin/package.json
{
  "name": "@module-federation/bridge-react-webpack-plugin",
  "version": "2.3.2"
  // no "files" field — everything gets published, including __tests__/
}

---

Suggested Fix

Add a files field to packages/bridge/bridge-react-webpack-plugin/package.json to allowlist only the dist output:

{
  "files": [
    "dist/",
    "README.md",
    "LICENSE"
  ]
}

Or add a .npmignore in packages/bridge/bridge-react-webpack-plugin/:

__tests__/
*.test.*
*.spec.*
vitest.config.ts
vite.config.ts

Either approach prevents test fixture files (and their mock package.json stubs declaring old CVE-affected router versions) from being included in the published tarball, eliminating the false-positive security scan blocks.

---

Environment

• Package: @module-federation/bridge-react-webpack-plugin@2.3.2
• Package manager: pnpm
• Security scanner: JFrog Xray
• Upstream chain: @module-federation/nextjs-mf@8.8.64 → @module-federation/enhanced@2.3.2 → @module-federation/bridge-react-webpack-plugin@2.3.2

Used Package Manager

pnpm

Validations

• Read the docs
• Checked that there isn't already an issue reporting the same bug (issue Resolve CVEs present in current react-router version #4474 is related but different — that was about a real dep, this is a false positive from test fixtures)
• This is a Module Federation issue (missing files field in package.json of bridge-react-webpack-plugin)

[MosheOhadSaban]

Thanks.
In practice, the issue is worse than it first appears because some security scanners only detect it during a deeper binary/package scan, not during the initial dependency resolution phase.

This means consumers cannot reliably work around it with overrides or similar package-manager features. The problematic files are being shipped under dist, while they are not represented as normal consumable dependencies in the root package package.json. Because of that, the scanner flags the published artifact itself, and the package may be blocked before installation can even complete.