registry / @feathery/react / 2.66.2
@feathery/react@2.66.2
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe suspicious signals are attributable to a browser form/assistant SDK and its explicit custom-component feature. Direct inspection found no concrete malicious behavior or install-time attack path.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders Feathery forms or enables configured assistant/custom-field features.
Impact
No unconsented install-time mutation, credential harvesting, or covert remote payload chain established.
Mechanism
Package-aligned browser SDK requests and user-configured iframe component execution.
AI rationale
The suspicious signals are attributable to a browser form/assistant SDK and its explicit custom-component feature. Direct inspection found no concrete malicious behavior or install-time attack path.
Evidence
package.jsoncjs/index.jsdist/fthry_index.74n2xru4.jsdist/fthry_AssistantChat.DsdEw0Ss.jsumd/CustomField.895d9a1d34e8e7b8b8d0.jsdist/index.js
Network endpoints4
api-static-2.feathery.io/api/cdn.feathery.io/api/m1.openfpcdn.io/fingerprintjs/www.google.com/generate_204
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `umd/CustomField.895d9a1d34e8e7b8b8d0.js` compiles and imports configured custom-component code in a sandboxed iframe.
- `dist/fthry_AssistantChat.DsdEw0Ss.js` uploads user-selected assistant attachments and document-index content to its configured API.
Evidence against
- `package.json` has only `prepare: husky` and `prepublishOnly: yarn build`; no install/preinstall/postinstall hook.
- `cjs/index.js` is a normal library entrypoint with no install-time execution.
- `dist/fthry_index.74n2xru4.js` routes SDK requests to declared Feathery API/CDN endpoints and attaches its session cookie only to those requests.
- No child-process, filesystem harvesting, persistence, destructive action, or covert exfiltration path was found in inspected runtime files.
- The high-entropy `.woff2` is a bundled font asset, not executable payload code.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
Source & flagged code
6 flaggeddist/fthry_AssistantChat.DsdEw0Ss.jsView file
10223// eslint-disable-next-line no-new-func
L10224: var importFromCdn = new Function('url', 'return import(url)');
L10225: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.DsdEw0Ss.jsView on unpkg · L10223dist/fthry_index.DimVcPfk.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.DimVcPfk.jsView on unpkg · L271umd/index.jsView file
Findings
5 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBrowser Session Account Hijackdist/fthry_index.74n2xru4.js
HighBase64 Obscured Urldist/fthry_index.74n2xru4.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
MediumDynamic Requiredist/fthry_index.DimVcPfk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.DsdEw0Ss.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.66.2.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.66.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.