registry / @feathery/react / 2.100.3
@feathery/react@2.100.3
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoints and required finding paths contain package-aligned browser functionality. Dynamic imports and credential handling did not establish a concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumers import the library and invoke its form or attachment features; no automatic install attack was identified.
Impact
The inspected code provides expected browser functionality; no malicious credential export, project mutation, or shell execution was established.
Mechanism
PDF modules load from a pinned CDN location, link credentials receive an origin check, and custom requests use backend endpoints.
AI rationale
The inspected entrypoints and required finding paths contain package-aligned browser functionality. Dynamic imports and credential handling did not establish a concrete malicious chain.
Network endpoints2
cdn.jsdelivr.net/npm/pdfjs-dist@api.feathery.io/api/
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook and no runtime self-dependency; prepare runs Husky.
- The PDF loader imports the pinned PDF.js 5.4.296 release from jsDelivr when loadPdfjs is called.
- AssistantChat loads PDF.js and configures its worker for attachment rendering.
- Link credentials are restricted by matching request origins to the configured backend origins.
- The country selector resolves its flag font from a sibling asset and invokes the font polyfill.
- Custom HTTP helpers send their request descriptions to Feathery backend endpoints.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.C-aFL9JX.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.C-aFL9JX.jsView on unpkg · L27dist/fthry_index.BtdRHuhN.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BtdRHuhN.jsView on unpkg · L3657cjs/fthry_index.C1xFaNTd.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_pdfjsLoader.C-aFL9JX.js
HighBrowser Session Account Hijackcjs/fthry_index.C1xFaNTd.js
HighBase64 Obscured Urlcjs/fthry_index.C1xFaNTd.js
HighSemantic Analysis Limitedcjs/fthry_index.BgLCCb_G.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.BtdRHuhN.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.BswNs79t.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.100.3.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.100.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.