@feathery/react
React library for Feathery
This report shows the evidence for @feathery/react@2.116.0. 0 of 65 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe package bundles FingerprintJS monitoring that is enabled by default and contacts a third-party host when fingerprint tracking is configured. The request is sampled and described as unpersonalized, so this is a warning-level telemetry concern rather than evidence of credential theft or account hijacking.
Decision evidence
public snapshot- Bundled FingerprintJS code sends an unpersonalized installation-statistics GET request to m1.openfpcdn.io.
- The request is sampled at 0.1%; monitoring is enabled by default in FingerprintJS load().
- The package calls load() during initialization when fingerprint user tracking is configured and no user ID is set.
- The telemetry request contains no explicit user or project data in its request code.
- The reported Base64 decoding converts image data URLs into files; it does not conceal an endpoint.
- Package entry points expose React form functionality, and the declared lifecycle scripts are prepare and prepublishOnly.
Source & flagged code
6 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
umd/index.jsView on unpkg · L1Package source references a known benign dynamic code generation pattern.
umd/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @feathery/react@2.116.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @feathery/react@2.116.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.