registry / @feathery/react / 2.113.0
@feathery/react@2.113.0
⚠ Under reviewReact library for Feathery
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe credential-related matches inspected are analytics delivery code, but the large UMD entrypoint's reported account-setting behavior remains unresolved after targeted review. Manual review is needed to establish whether that behavior is reachable and authorized.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Consumers load the UMD browser entrypoint.
Impact
The available source excerpts do not establish credential theft or unauthorized account changes; unresolved UMD behavior prevents a clean determination.
Mechanism
The reviewed analytics paths batch events and send them through configured delivery settings; the targeted UMD inspection did not resolve the reported account-setting path.
AI rationale
The credential-related matches inspected are analytics delivery code, but the large UMD entrypoint's reported account-setting behavior remains unresolved after targeted review. Manual review is needed to establish whether that behavior is reachable and authorized.
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest routes consumers to CJS, ESM, and UMD builds; its prepare hook runs Husky and prepublishOnly runs the build.
- The inspected analytics code sends event batches through configured HTTP delivery and supports a page-unload flush.
- The bundle wires the batching or standard analytics transport to configured delivery settings.
Evidence against
- The inspected analytics transport is connected to Segment analytics initialization; these excerpts do not establish that it exports saved service credentials.
- The UMD build is a large bundled entrypoint, and the targeted inspection did not resolve the reported account-setting behavior.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggedumd/index.jsView file
1/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
umd/index.jsView on unpkg · L11/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
Low
Eval
Package source references a known benign dynamic code generation pattern.
umd/index.jsView on unpkg · L1dist/fthry_index.D9TmVI0I.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Findings
4 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlcjs/fthry_index.DmrUdLss.js
HighSemantic Analysis Limitedcjs/fthry_index.BbH99yM5.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltacjs/fthry_index.DNinn0T0.js
MediumDynamic Requiredist/fthry_index.D9TmVI0I.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.BijYwvVq.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalumd/index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @feathery/react@2.113.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.113.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.