registry / @feathery/react / 2.106.0
@feathery/react@2.106.0
React library for Feathery
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe reviewed source supports ordinary library functionality, and the scanner’s suspicious labels do not establish a concrete attack. The package manifest’s prepare and prepublishOnly scripts invoke Husky setup and a build.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application use of the library’s PDF or assistant features.
Impact
No confirmed unrelated payload execution, credential exfiltration, or account mutation was established.
Mechanism
The PDF-related code dynamically imports a pinned PDF.js module, assistant code decodes audio chunks, and the main CJS bundle configures Feathery API endpoints.
AI rationale
The reviewed source supports ordinary library functionality, and the scanner’s suspicious labels do not establish a concrete attack. The package manifest’s prepare and prepublishOnly scripts invoke Husky setup and a build.
Network endpoints2
api.feathery.io/staging.feathery.io/api/
Decision evidence
public snapshotAI called this Clean at 81.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json assigns prepare to Husky setup and prepublishOnly to the build.
- The assistant bundle dynamically imports a version-pinned PDF.js module from its CDN for PDF support.
- The main bundle configures requests to Feathery API hosts; no reviewed source establishes an unrelated credential recipient.
- The assistant UMD excerpt decodes audio chunks for playback; no remote-payload execution is established there.
- The additional CJS entry begins by requiring the main CJS bundle.
Evidence against
- Static scanner findings alone do not establish malicious behavior.
- The inspected suspicious primitives align with PDF loading, audio playback, and product API requests.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_AssistantChat.DpA4tCNA.jsView file
10388// eslint-disable-next-line no-new-func
L10389: var importFromCdn = new Function('url', 'return import(url)');
L10390: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.DpA4tCNA.jsView on unpkg · L10388dist/fthry_index.DrbRtw7M.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.DrbRtw7M.jsView on unpkg · L3657cjs/fthry_index.zLcb1H7E.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_AssistantChat.DpA4tCNA.js
HighBrowser Session Account Hijackcjs/fthry_index.zLcb1H7E.js
HighBase64 Obscured Urlcjs/fthry_index.zLcb1H7E.js
HighSemantic Analysis Limitedcjs/fthry_index.AD9f12JM.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.DrbRtw7M.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.CMEjsMxk.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.106.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.106.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.