registry / @feathery/react / 2.67.0
@feathery/react@2.67.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection found a browser-focused Feathery form SDK with aligned API traffic and optional analytics/fingerprinting features, not malware behavior. Static child-process and eval signals are false/noisy except for a scoped PDF CDN import.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer initializes/renders Feathery forms; PDF thumbnail rendering triggers the optional PDF loader.
Impact
No credential harvesting, host mutation, persistence, or unconsented execution chain was established.
Mechanism
Package-aligned form API requests and optional pinned CDN PDF module import.
AI rationale
Source inspection found a browser-focused Feathery form SDK with aligned API traffic and optional analytics/fingerprinting features, not malware behavior. Static child-process and eval signals are false/noisy except for a scoped PDF CDN import.
Evidence
package.jsoncjs/index.jscjs/fthry_index.3plOpctu.jscjs/fthry_AssistantChat.CI46_z6j.js
Network endpoints3
api.feathery.io/api/cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjscdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.worker.min.mjs
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `cjs/fthry_AssistantChat.CI46_z6j.js` dynamically imports pinned pdfjs-dist from jsDelivr for PDF thumbnails.
- `cjs/fthry_index.3plOpctu.js` supports configured form API requests, cookies, and optional fingerprint/analytics integrations.
Evidence against
- `package.json` has no preinstall/install/postinstall hook; `prepare` only invokes Husky.
- `cjs/index.js` is a React entrypoint loading bundled UI code.
- No Node fs, child_process, shell, or native-loading calls were found in shipped JS.
- The dynamic import is a documented, pinned CDN dependency used only by `loadPdfjs`.
- Feathery API URLs in `cjs/fthry_index.3plOpctu.js` are package-aligned form-service endpoints.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/fthry_AssistantChat.DDEvvzRb.jsView file
10383// eslint-disable-next-line no-new-func
L10384: var importFromCdn = new Function('url', 'return import(url)');
L10385: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.DDEvvzRb.jsView on unpkg · L10383dist/fthry_index.uBhg8dV1.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.uBhg8dV1.jsView on unpkg · L74umd/index.jsView file
Findings
6 High4 Medium5 Low
HighChild Process
HighSame File Env Network Executionumd/index.js
HighBrowser Session Account Hijackdist/fthry_index.0Mz4FkHk.js
HighBase64 Obscured Urldist/fthry_index.0Mz4FkHk.js
HighShips High Entropy Blobdist/TwemojiCountryFlags.woff2
HighSemantic Analysis Limitedcjs/fthry_index.3plOpctu.js
MediumDynamic Requiredist/fthry_index.uBhg8dV1.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.DDEvvzRb.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @feathery/react@2.67.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.67.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.