registry / @feathery/react / 2.53.0
@feathery/react@2.53.0
React library for Feathery
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection shows a browser React SDK with configuration-gated form, analytics, support, identity, and chat integrations. It contains no concrete malicious install-time, local-system, credential-harvesting, persistence, or unconsented remote-execution behavior.
Static reason
No blocking static signals were detected.
Trigger
A host application renders or configures Feathery forms, analytics, support, or assistant-chat integrations.
Impact
Configured integrations can send form/chat data to their intended services; no unconsented local mutation or remote payload chain was found.
Mechanism
Configuration-gated browser API calls and third-party integration script loading.
AI rationale
Static source inspection shows a browser React SDK with configuration-gated form, analytics, support, identity, and chat integrations. It contains no concrete malicious install-time, local-system, credential-harvesting, persistence, or unconsented remote-execution behavior.
Evidence
package.jsoncjs/index.jscjs/fthry_index.DIcj_VUJ.jscjs/fthry_AssistantChat.Cdt71IEA.jsumd/602.ddda17ac6b2cabb3d639.jscjs/fthry_index.C-Tcdfmc.jscjs/fthry_index.CxY6K5_1.js
Network endpoints4
cdn.heapanalytics.comapi-iam.intercom.iowidget.intercom.iocdn.amplitude.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `package.json` defines `prepare: husky`, but ships no `.husky` configuration.
- `cjs/fthry_index.DIcj_VUJ.js` can load configured analytics/support scripts at runtime.
- `cjs/fthry_AssistantChat.Cdt71IEA.js` posts chat and optional voice data to its configured base URL.
- `umd/602.ddda17ac6b2cabb3d639.js` contains `new Function("")` feature detection.
Evidence against
- No `preinstall`, `install`, or `postinstall` lifecycle hook is declared in `package.json`.
- No `child_process` import or filesystem write/read primitive was found in shipped JavaScript.
- `cjs/index.js` imports the packaged React implementation; no import-time network or shell execution was found.
- Analytics loaders in `cjs/fthry_index.DIcj_VUJ.js` are guarded by supplied integration configuration.
- `process.env` use is environment selection and development-library checks, not credential harvesting.
- No AI-agent config, shell persistence, credential exfiltration, or destructive behavior was found.
Behavioral surface
ChildProcessDynamicRequire
Source & flagged code
5 flaggedumd/602.ddda17ac6b2cabb3d639.jsView file
1(this.webpackChunkFeathery=this.webpackChunkFeathery||[]).push([[602],{94470:e=>{"use strict";var t=Object.prototype.hasOwnProperty,n=Object.prototype.toString,r=Object.definePrope...
Low
Eval
Package source references a known benign dynamic code generation pattern.
umd/602.ddda17ac6b2cabb3d639.jsView on unpkg · L1dist/fthry_index.BfZgFvaE.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BfZgFvaE.jsView on unpkg · L74umd/index.jsView file
Findings
4 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
HighOversized Source Filedist/fthry_index.4QNSIT1t.js
MediumDynamic Requiredist/fthry_index.BfZgFvaE.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalumd/602.ddda17ac6b2cabb3d639.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.53.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.53.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.