registry / @feathery/react / 2.102.1
@feathery/react@2.102.1
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected source supports ordinary library behavior and does not substantiate the scanner's remote payload or account-hijack claims. No concrete malicious execution or install-time attack was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Rendering PDF attachments or using authenticated forms activates the inspected runtime features; no malicious activation was identified.
Impact
No malicious account mutation, unrelated credential export, or decoded payload execution was established.
Mechanism
PDF rendering imports a pinned library, and link authentication checks destination origins before adding credentials.
AI rationale
The inspected source supports ordinary library behavior and does not substantiate the scanner's remote payload or account-hijack claims. No concrete malicious execution or install-time attack was identified.
Network endpoints1
cdn.jsdelivr.net/npm/pdfjs-dist@
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; prepare runs Husky and prepublishOnly builds the library.
- The chat bundles dynamically import PDF.js for PDF rendering; the loader pins pdfjs-dist to version 5.4.296 on jsDelivr.
- Link credentials are attached only when the request origin matches the configured API or static backend origin.
- The flagged Base64 decoding converts data into an ArrayBuffer, rather than decoding an obscured endpoint.
- The flagged country dropdown resolves a bundled font asset and applies a font polyfill.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_AssistantChat.BGMb7hLD.jsView file
10388// eslint-disable-next-line no-new-func
L10389: var importFromCdn = new Function('url', 'return import(url)');
L10390: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.BGMb7hLD.jsView on unpkg · L10388dist/fthry_index.BJNkcahE.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BJNkcahE.jsView on unpkg · L3657cjs/fthry_index.D2C5QHvC.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_AssistantChat.BGMb7hLD.js
HighBrowser Session Account Hijackcjs/fthry_index.D2C5QHvC.js
HighBase64 Obscured Urlcjs/fthry_index.D2C5QHvC.js
HighSemantic Analysis Limitedcjs/fthry_index.B3cFuWeF.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.BJNkcahE.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.D1H_I6Py.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.102.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.102.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.