registry / @feathery/react / 2.55.1
@feathery/react@2.55.1
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection shows a browser React SDK with package-aligned Feathery networking and a user-configured custom-component facility. Scanner signals stem from bundled dependencies and normal encoding/runtime features, not a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders a Feathery form; custom code execution requires configured component code.
Impact
No confirmed unconsented host mutation, credential harvesting, exfiltration, or remote payload execution.
Mechanism
Browser form rendering, API requests, and sandboxed custom-component preview.
AI rationale
Direct inspection shows a browser React SDK with package-aligned Feathery networking and a user-configured custom-component facility. Scanner signals stem from bundled dependencies and normal encoding/runtime features, not a concrete malicious chain.
Evidence
package.jsondist/index.jsdist/fthry_index._KlQAXCm.jsdist/fthry_AssistantChat.CFzkd8QB.jscjs/index.jscjs/thumbnail-renderer.jsdist/thumbnail-renderer.jsumd/index.js
Network endpoints6
api.feathery.io/api/staging.feathery.io/api/api-au.feathery.io/api/api-eu.feathery.io/api/api-ca.feathery.io/api/m1.openfpcdn.io/fingerprintjs/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- User-supplied custom-component code is compiled and imported in a sandboxed iframe at runtime.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare only invokes husky.
- Entrypoints are browser React/form-rendering bundles.
- No child-process, filesystem-harvesting, credential-exfiltration, or persistence behavior found.
- Base64 uses are image/file and WebAuthn encoding, not an obscured endpoint.
- Network constants target Feathery APIs and bundled service integrations.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/fthry_AssistantChat.CFzkd8QB.jsView file
10099// eslint-disable-next-line no-new-func
L10100: var importFromCdn = new Function('url', 'return import(url)');
L10101: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.CFzkd8QB.jsView on unpkg · L10099dist/fthry_index.BJvyzCAc.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BJvyzCAc.jsView on unpkg · L271umd/index.jsView file
Findings
4 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBase64 Obscured Urldist/fthry_index._KlQAXCm.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
MediumDynamic Requiredist/fthry_index.BJvyzCAc.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.CFzkd8QB.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.55.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.55.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.