registry / @feathery/react / 2.114.0
@feathery/react@2.114.0
React library for Feathery
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The flagged transport belongs to analytics event delivery, and the account identity path is controlled by the form's identify_user setting.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The library runs when a consumer renders a form and its configured analytics integration is used.
Impact
No unauthorized credential disclosure or account change was established.
Mechanism
Analytics batches are posted to the configured host with the analytics write key; the form integration includes user identity only when enabled in metadata.
AI rationale
Source inspection found no concrete attack behavior. The flagged transport belongs to analytics event delivery, and the account identity path is controlled by the form's identify_user setting.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the React library, points to its CJS and ESM entries, and uses build and Husky lifecycle scripts.
- The analytics bundle batches events to its configured host using an analytics write key; its callers handle flushing and retrying those batches. This is not a saved Feathery session credential transfer.
- The form integration includes a user identity in analytics only when the identify_user setting is enabled.
- The reviewed entry bundles and dependency files show React, JSZip, Emotion, and React support modules; the encoded strings inspected in the main bundle serve ad-block filters or image data, while Feathery API defaults use Feathery hosts.
- No unauthorized account change or concrete attack behavior was identified in the inspected source.
Evidence against
- Static alerts for account hijacking and an encoded URL were not confirmed as unauthorized account actions or credential forwarding in the inspected source.
Behavioral surface
DynamicRequireEnvironmentVarsEval
Source & flagged code
7 flaggedumd/index.jsView file
1/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
umd/index.jsView on unpkg · L11/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
Low
Eval
Package source references a known benign dynamic code generation pattern.
umd/index.jsView on unpkg · L1dist/fthry_index.-kSgUoeE.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Findings
4 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlcjs/fthry_index.DwjnOqgw.js
HighSemantic Analysis Limitedcjs/fthry_index.C-40_lZw.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltacjs/fthry_index.4AJ3zYvt.js
MediumDynamic Requiredist/fthry_index.-kSgUoeE.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.8SvXxlhO.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalumd/index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @feathery/react@2.114.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.114.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.