registry / @feathery/react / 2.65.0
@feathery/react@2.65.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged primitives are bundled browser-library functionality with package-aligned endpoints. Source inspection found no concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders package features such as forms, chat, or PDF thumbnails.
Impact
No unconsented install-time execution, persistence, or exfiltration identified.
Mechanism
browser API requests and fixed-version PDF.js CDN import
AI rationale
The flagged primitives are bundled browser-library functionality with package-aligned endpoints. Source inspection found no concrete malicious behavior.
Evidence
package.jsoncjs/index.jsdist/fthry_AssistantChat.DwQF3MZ-.jsdist/fthry_index.BNuvKJ2Z.jsumd/index.js
Network endpoints2
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjsapi.feathery.io/api/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime CDN module import exists in dist/fthry_AssistantChat.DwQF3MZ-.js.
Evidence against
- package.json has no install/preinstall/postinstall hook; prepare runs Husky only.
- cjs/index.js is a normal React library entrypoint.
- Assistant bundle pins PDF.js to jsdelivr and loads it only for PDF thumbnail support.
- Base64 use in dist/fthry_index.BNuvKJ2Z.js is Zod/JWT validation, not URL decoding.
- Feathery API endpoints are package-aligned form-service calls.
- No child_process, credential harvesting, filesystem mutation, or agent-control writes found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/fthry_AssistantChat.DwQF3MZ-.jsView file
10223// eslint-disable-next-line no-new-func
L10224: var importFromCdn = new Function('url', 'return import(url)');
L10225: var pdfjsPromise = null;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_AssistantChat.DwQF3MZ-.jsView on unpkg · L1022310223// eslint-disable-next-line no-new-func
L10224: var importFromCdn = new Function('url', 'return import(url)');
L10225: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.DwQF3MZ-.jsView on unpkg · L10223umd/index.jsView file
1/*! For license information please see index.js.LICENSE.txt */
L2: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.Feathery=t()...
Findings
5 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBrowser Session Account Hijackdist/fthry_index.BNuvKJ2Z.js
HighBase64 Obscured Urldist/fthry_index.BNuvKJ2Z.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
MediumDynamic Requiredist/fthry_AssistantChat.DwQF3MZ-.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.DwQF3MZ-.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.65.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.65.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.