registry / @feathery/react / 2.62.0
@feathery/react@2.62.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged primitives are package-aligned browser UI behavior, not install-time or covert attack behavior. Static inspection found no concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Rendering a PDF attachment thumbnail in the assistant UI.
Impact
Loads pdfjs-dist to render the supplied PDF; no package-origin credential or filesystem exfiltration observed.
Mechanism
Dynamic CDN import for PDF rendering.
AI rationale
The flagged primitives are package-aligned browser UI behavior, not install-time or covert attack behavior. Static inspection found no concrete malicious chain.
Evidence
package.jsoncjs/index.jscjs/fthry_AssistantChat.qJ_OVVyR.jscjs/TwemojiCountryFlags.woff2
Network endpoints2
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjscdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.worker.min.mjs
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Assistant bundle dynamically imports pinned pdfjs-dist from jsDelivr.
- The import is activated by the PDF-thumbnail React effect.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare only invokes Husky.
- cjs/index.js only loads bundled React library modules on import.
- The dynamic import is documented and fixed to pdfjs-dist@5.4.296.
- No child_process, filesystem harvesting, credential access, persistence, or destructive code was found.
- TwemojiCountryFlags.woff2 is a WOFF2 font asset, not executable payload.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/fthry_AssistantChat.De6ohiu0.jsView file
10179// eslint-disable-next-line no-new-func
L10180: var importFromCdn = new Function('url', 'return import(url)');
L10181: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.De6ohiu0.jsView on unpkg · L10179dist/fthry_index.DAlnO8lI.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.DAlnO8lI.jsView on unpkg · L3657umd/index.jsView file
Findings
4 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBase64 Obscured Urldist/fthry_index.DOBzoef7.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
MediumDynamic Requiredist/fthry_index.DAlnO8lI.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.De6ohiu0.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.62.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.62.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.