registry / @feathery/react / 2.111.0
@feathery/react@2.111.0
⚠ Under reviewReact library for Feathery
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest and reviewed bundle excerpts support ordinary React library behavior, and the Base64 match examined belongs to an ad-block filter list. The large minified UMD bundle leaves the scanner’s account-mutation claim unresolved, so the package needs further review before a clean verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Unknown; the inspected excerpts do not establish when the relevant UMD code runs.
Impact
Unknown; no harmful effect was verified from the inspected excerpts.
Mechanism
The bundle includes a cookie-reading helper and analytics identification behavior, but the inspected source does not establish credential transfer or account mutation.
AI rationale
The manifest and reviewed bundle excerpts support ordinary React library behavior, and the Base64 match examined belongs to an ad-block filter list. The large minified UMD bundle leaves the scanner’s account-mutation claim unresolved, so the package needs further review before a clean verdict.
Evidence
umd/index.js
Decision evidence
public snapshotAI called this Manual Review at 57.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest points to React library entrypoints and shows a build hook plus a Husky prepare hook.
- The UMD bundle contains a cookie-reading helper and analytics code that can identify a user; the inspected excerpts do not establish the callers, destinations, or whether unrelated account changes occur.
- A Base64 match in the UMD bundle appears in an ad-block filter list, which does not verify the flagged hidden endpoint.
Evidence against
- The inspected excerpts do not establish credential export, an unrelated account action, or malicious install-time behavior.
- The flagged UMD behavior remains unresolved because the bundle is a very large minified file and the relevant call paths were not established.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
6 flaggeddist/fthry_AssistantChat.DfEMtMHE.jsView file
12097// eslint-disable-next-line no-new-func
L12098: var importFromCdn = new Function('url', 'return import(url)');
L12099: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.DfEMtMHE.jsView on unpkg · L12097dist/fthry_index.nOjWdcU2.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.nOjWdcU2.jsView on unpkg · L271umd/index.jsView file
Findings
3 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlumd/index.js
HighSemantic Analysis Limitedcjs/fthry_index.C5j_bPdI.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.nOjWdcU2.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.Dstb1HE9.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.DfEMtMHE.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.111.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.111.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.