registry / @feathery/react / 2.68.0
@feathery/react@2.68.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged primitives are package-aligned browser form/integration functionality. Inspection found no concrete malicious chain or install-time attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders/configures Feathery forms, integrations, assistant chat, or PDF previews.
Impact
No credential harvesting, host-file access, install-time mutation, persistence, or unconsented control-surface modification found.
Mechanism
User-configured browser API and third-party integration requests.
AI rationale
The flagged primitives are package-aligned browser form/integration functionality. Inspection found no concrete malicious chain or install-time attack behavior.
Evidence
package.jsoncjs/index.jscjs/fthry_index.NFGOE2mD.jsdist/fthry_AssistantChat.aLwQvUi_.jsdist/fthry_index.BYMoLisv.js
Network endpoints3
api.feathery.io/api/cdn.plaid.com/link/v2/stable/link-initialize.jscdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjs
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime loaders can fetch configured integration scripts, including Plaid.
- Assistant PDF preview uses a pinned jsDelivr dynamic import.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepare runs husky only.
- cjs/index.js exports React form components; import-time work is compatibility polyfills.
- cjs/fthry_index.NFGOE2mD.js uses Feathery API URLs and caller SDK keys for form operations.
- Base64/atob in dist/fthry_AssistantChat.aLwQvUi_.js validates Base64/JWT formats, not concealed endpoint decoding.
- new Function dynamically imports a pinned pdfjs-dist URL for PDF thumbnails.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/fthry_AssistantChat.aLwQvUi_.jsView file
10383// eslint-disable-next-line no-new-func
L10384: var importFromCdn = new Function('url', 'return import(url)');
L10385: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.aLwQvUi_.jsView on unpkg · L10383dist/fthry_index.BuSP4UBi.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BuSP4UBi.jsView on unpkg · L271dist/fthry_index.BYMoLisv.jsView file
Findings
3 High4 Medium5 Low
HighBrowser Session Account Hijackdist/fthry_index.BYMoLisv.js
HighBase64 Obscured Urldist/fthry_index.BYMoLisv.js
HighSemantic Analysis Limitedcjs/fthry_index.NFGOE2mD.js
MediumDynamic Requiredist/fthry_index.BuSP4UBi.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.aLwQvUi_.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.68.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.68.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.