registry / @feathery/react / 2.55.0
@feathery/react@2.55.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection shows a browser-oriented React package with no install-time execution or malicious host behavior. Scanner signals arise from bundled dependencies and documented lazy PDF loading.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer renders AssistantChat or uses PDF thumbnail functionality.
Impact
Expected application functionality; no unconsented host mutation or exfiltration chain found.
Mechanism
lazy UI module loading and user-initiated attachment/PDF processing
AI rationale
Direct inspection shows a browser-oriented React package with no install-time execution or malicious host behavior. Scanner signals arise from bundled dependencies and documented lazy PDF loading.
Evidence
package.jsoncjs/index.jscjs/fthry_index.BF-anQOj.jsdist/fthry_AssistantChat.Be6Mlyxj.jsdist/index.jsdist/fthry_index.BEMCjmqu.js
Network endpoints2
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjscdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.worker.min.mjs
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/fthry_AssistantChat.Be6Mlyxj.js dynamically imports pinned pdfjs from jsDelivr.
- Assistant attachment code uploads user-selected files to its configured same-origin API.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare only invokes husky.
- cjs/index.js imports the package bundle; no install-time shell or file mutation found.
- cjs/fthry_index.BF-anQOj.js lazily loads AssistantChat only when rendered.
- The flagged new Function is a fixed dynamic import helper for a pinned PDF.js URL.
- Base64 use is bundled Zod validation and audio/PDF handling, not decoded command execution.
- No child_process, credential harvesting, persistence, or AI-agent configuration writes found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/fthry_AssistantChat.Be6Mlyxj.jsView file
10099// eslint-disable-next-line no-new-func
L10100: var importFromCdn = new Function('url', 'return import(url)');
L10101: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.Be6Mlyxj.jsView on unpkg · L10099dist/fthry_index.9S43igFs.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.9S43igFs.jsView on unpkg · L271umd/index.jsView file
Findings
5 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBase64 Obscured Urldist/fthry_index.BEMCjmqu.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
HighPrevious Version Dangerous Deltacjs/fthry_index.BF-anQOj.js
MediumDynamic Requiredist/fthry_index.9S43igFs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.Be6Mlyxj.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.55.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.55.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.