registry / @feathery/react / 2.66.0
@feathery/react@2.66.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection shows a browser React library with explicit runtime extension/rendering features, not malicious install-time or covert data-handling behavior. Scanner signals arise from bundled dependencies and intended dynamic browser functionality.
Static reason
One or more suspicious static signals were detected.
Trigger
A host application explicitly renders a custom field or PDF/chat feature.
Impact
Host-provided custom code may run in its intended iframe context; no unconsented installation-time or credential-exfiltration chain was found.
Mechanism
User-configured browser component execution and pinned CDN module import.
AI rationale
Source inspection shows a browser React library with explicit runtime extension/rendering features, not malicious install-time or covert data-handling behavior. Scanner signals arise from bundled dependencies and intended dynamic browser functionality.
Evidence
package.jsondist/fthry_index.yO8J-w4n.jsdist/fthry_AssistantChat.XzRCZRiU.jscjs/index.jsdist/fthry_index.D1WKUEU6.jsumd/CustomField.895d9a1d34e8e7b8b8d0.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/fthry_index.yO8J-w4n.js builds an iframe that compiles and imports user-supplied custom React component code.
- dist/fthry_AssistantChat.XzRCZRiU.js uses new Function only to dynamically import pinned pdfjs-dist CDN modules.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare only invokes husky.
- No child_process, Node filesystem, credential harvesting, or exfiltration behavior found in distributed JS.
- Custom-field network imports and code execution are runtime features driven by configured component code, not install/import-time behavior.
- The flagged WOFF2 is a font asset; no executable payload was identified.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/fthry_AssistantChat.XzRCZRiU.jsView file
10223// eslint-disable-next-line no-new-func
L10224: var importFromCdn = new Function('url', 'return import(url)');
L10225: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.XzRCZRiU.jsView on unpkg · L10223dist/fthry_index.yO8J-w4n.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.yO8J-w4n.jsView on unpkg · L74umd/index.jsView file
Findings
5 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBrowser Session Account Hijackdist/fthry_index.Bzo34Vy4.js
HighBase64 Obscured Urldist/fthry_index.Bzo34Vy4.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
MediumDynamic Requiredist/fthry_index.yO8J-w4n.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.XzRCZRiU.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.66.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.66.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.