registry / @feathery/react / 2.115.0
@feathery/react@2.115.0
React library for Feathery
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged credential handling and account connection code fit the package’s Feathery form integration, and the Base64 strings are ad-block selector data. I found no automatic account mutation, unrelated credential transfer, or harmful install behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Normal package use; account connection requires a popup, and Segment tracking requires integration configuration.
Impact
No unsolicited account changes or unrelated credential disclosure identified.
Mechanism
The session cookie is attached by the Feathery API helper, while account connection and analytics follow their respective product flows.
AI rationale
The flagged credential handling and account connection code fit the package’s Feathery form integration, and the Base64 strings are ad-block selector data. I found no automatic account mutation, unrelated credential transfer, or harmful install behavior.
Network endpoints8
api.feathery.ioapi-au.feathery.ioapi-eu.feathery.ioapi-ca.feathery.ioapi-jp.feathery.iostaging.feathery.iowww.google.comm1.openfpcdn.io
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports compiled React entry points; its prepublishOnly script builds the package and prepare runs Husky.
- The browser helper reads the Feathery session cookie and attaches it to requests made through the Feathery API helper; the listed API hosts are Feathery domains.
- Account connection requires a popup and calls the account-connect flow after that permission check.
- The Base64 strings flagged in the CJS bundle are ad-block filter selectors, not a concealed runtime endpoint.
- Segment tracking is conditional on configured integration metadata; user IDs and submitted fields are included only under configured conditions.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggedumd/index.jsView file
1/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
umd/index.jsView on unpkg · L11/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
Low
Eval
Package source references a known benign dynamic code generation pattern.
umd/index.jsView on unpkg · L1dist/fthry_index.DCjCE0TJ.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Findings
3 High5 Medium7 Low
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlcjs/fthry_index.CszLaNLI.js
HighSemantic Analysis Limitedcjs/fthry_index.554M2up9.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.DCjCE0TJ.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.Cp2UBGOC.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalumd/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.115.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.115.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.