registry / @feathery/react / 2.114.2
@feathery/react@2.114.2
React library for Feathery
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource inspection resolved the high-signal alerts as SDK form requests and configured analytics delivery. The manifest's lifecycle commands are build and repository setup tasks, and no concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
The SDK runs when a consumer uses its form or integration features and when configured analytics is initialized.
Impact
No unrequested account change, unrelated credential disclosure, or install-time attack was established.
Mechanism
Form requests use Feathery service endpoints; analytics sends buffered events through its configured delivery host.
AI rationale
Source inspection resolved the high-signal alerts as SDK form requests and configured analytics delivery. The manifest's lifecycle commands are build and repository setup tasks, and no concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as a Feathery React library; its prepare and prepublishOnly scripts run repository setup and build commands.
- The SDK attaches its session token to Feathery requests. Custom-request details, including the caller's target URL, are sent to Feathery's configured service endpoint; no unrelated credential recipient was found.
- The flagged analytics code batches events through a configurable analytics host and initializes its Segment integration from settings. The inspected excerpts show delivery and retry handling, not account-setting changes.
- The inspected entrypoints and flagged chunks link to React components, form functionality, phone metadata and ordinary styling dependencies.
Evidence against
- Static findings describe account hijacking and an obscured endpoint, but inspected source did not establish an unrelated credential transfer or unrequested account action.
- The reviewed lifecycle scripts do not perform install-time collection or mutation.
Behavioral surface
DynamicRequireEnvironmentVars
Source & flagged code
6 flaggedumd/index.jsView file
1/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
umd/index.jsView on unpkg · L11/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
Low
Eval
Package source references a known benign dynamic code generation pattern.
umd/index.jsView on unpkg · L1dist/fthry_index.BGfP53-a.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Findings
3 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlcjs/fthry_index.BVqih2-M.js
HighSemantic Analysis Limitedcjs/fthry_index.BVqih2-M.js
MediumDynamic Requiredist/fthry_index.BGfP53-a.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.DamSXYSS.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalumd/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.114.2.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.114.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.