registry / @feathery/react / 2.106.1
@feathery/react@2.106.1
React library for Feathery
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe bundle contains a concrete request-tampering capability in a DocuSign signing flow, while nearby code suggests a possible draft workflow. That unresolved behavior warrants a warning, but the inspected source does not establish a broader attack or justify blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading and running the UMD bundle in a page containing the matching DocuSign signing workflow.
Impact
The request may report a changed signing status; the excerpts do not establish what the recipient service does with that value.
Mechanism
It wraps XMLHttpRequest.send, changes the status field in matching signing request data to "sent", then calls the original send function.
AI rationale
The bundle contains a concrete request-tampering capability in a DocuSign signing flow, while nearby code suggests a possible draft workflow. That unresolved behavior warrants a warning, but the inspected source does not establish a broader attack or justify blocking publication.
Evidence
umd/index.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The UMD bundle is exposed through the package's jsDelivr entry.
- The UMD bundle replaces XMLHttpRequest.send and changes DocuSign signing status data to "sent".
- The altered request data is passed to the original send method.
- The same bundle changes the DocuSign dialog to draft-related wording, suggesting a specialized workflow; no broader attack was established.
Evidence against
- The manifest identifies the package as a React library and its standard module entries point to CJS and ESM bundles.
- The inspected CJS file begins with imports of React and related UI modules.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggeddist/fthry_AssistantChat.Zw4b54hO.jsView file
10387// eslint-disable-next-line no-new-func
L10388: var importFromCdn = new Function('url', 'return import(url)');
L10389: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.Zw4b54hO.jsView on unpkg · L10387dist/fthry_index.BEzf6zno.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BEzf6zno.jsView on unpkg · L271umd/index.jsView file
Findings
3 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlumd/index.js
HighSemantic Analysis Limitedcjs/fthry_index.BMTOJYFB.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.BEzf6zno.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.CAjuQzwe.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.Zw4b54hO.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.106.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.106.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.