registry / @feathery/react / 2.114.1
@feathery/react@2.114.1
React library for Feathery
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest’s install hooks perform build and repository setup tasks. Runtime review resolved the flagged analytics transport and user-key update as SDK operations, with no inspected source showing an unrelated credential recipient or automatic account mutation.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports the SDK and its application invokes form, identity, or analytics functionality.
Impact
The inspected behavior does not establish unauthorized credential transfer or an unrequested account change.
Mechanism
The SDK sends requests to configured service endpoints; analytics uses its write key, while the user-key update targets the Feathery user endpoint.
AI rationale
The manifest’s install hooks perform build and repository setup tasks. Runtime review resolved the flagged analytics transport and user-key update as SDK operations, with no inspected source showing an unrelated credential recipient or automatic account mutation.
Network endpoints3
api.feathery.io/api/api-au.feathery.io/api/api-eu.feathery.io/api/
Decision evidence
public snapshotAI called this Clean at 80.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest routes imports to the CommonJS and browser SDK bundles; its install hooks run the build or Husky setup.
- The SDK’s default API hosts belong to Feathery, and its session header is attached by the API request helper.
- Analytics sends event batches to its configured host using its analytics write key; credentials are passed from analytics configuration.
- The user-key update method sends a PATCH to the Feathery user endpoint, and its caller requests that update only when the merge option is enabled.
- The inspected entry bundles and chunks load React, form UI, and supporting libraries; the flagged chunks do not establish an attack.
Evidence against
- The source includes browser fingerprinting and analytics functionality, but the inspected paths do not show those features exporting Feathery session credentials to an unrelated recipient or making an unrequested account change.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
6 flaggedumd/index.jsView file
1/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
umd/index.jsView on unpkg · L11/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
Low
Eval
Package source references a known benign dynamic code generation pattern.
umd/index.jsView on unpkg · L1dist/fthry_index.ZHFIUXyT.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Findings
3 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlcjs/fthry_index.D_aEDDgP.js
HighSemantic Analysis Limitedcjs/fthry_index.B218bivR.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.ZHFIUXyT.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.CfRPVBI2.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalumd/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.114.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.114.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.