registry / @feathery/react / 2.100.0
@feathery/react@2.100.0
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found package-aligned React, PDF-rendering, and configured API behavior. No malicious lifecycle hook or concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing and using the React components activates their normal runtime behavior.
Impact
No unconsented installation-time action, credential export, destructive behavior, or remote code execution was established.
Mechanism
The PDF helper dynamically imports a pinned PDF.js module; form and assistant components make configured service requests with origin-gated link headers.
AI rationale
Static inspection found package-aligned React, PDF-rendering, and configured API behavior. No malicious lifecycle hook or concrete attack behavior was found.
Evidence
package.jsondist/fthry_pdfjsLoader.C-aFL9JX.jscjs/fthry_index.ZlSOmqvr.jsumd/AssistantChat.ffe51618203f111a02c8.jscjs/fthry_index.BGUs3pRD.js
Network endpoints1
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata identifies browser library entrypoints and a publication build script.
- The PDF helper loads a pinned PDF.js release from jsDelivr for document rendering.
- Link credentials are attached only after the request origin matches configured API or static-service origins.
- The assistant bundle constructs its thread route from its supplied base URL and issues normal browser fetch requests.
- The secondary CommonJS bundle imports the primary package module.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.C-aFL9JX.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.C-aFL9JX.jsView on unpkg · L27dist/fthry_index.CjRWGh5F.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.CjRWGh5F.jsView on unpkg · L271cjs/fthry_index.ZlSOmqvr.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_pdfjsLoader.C-aFL9JX.js
HighBrowser Session Account Hijackcjs/fthry_index.ZlSOmqvr.js
HighBase64 Obscured Urlcjs/fthry_index.ZlSOmqvr.js
HighSemantic Analysis Limitedcjs/fthry_index.BGUs3pRD.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.CjRWGh5F.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.CQ1bNuVu.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.100.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.100.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.