registry / @feathery/react / 2.70.0
@feathery/react@2.70.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged primitives implement documented browser form, chat, attachment, and PDF-preview functionality. Source inspection found no concrete malicious behavior or install-time attack chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders AssistantChat, uploads an attachment, or requests a PDF thumbnail.
Impact
No unconsented install-time execution, credential harvesting, or exfiltration chain established.
Mechanism
Feature-scoped browser fetches and pinned CDN module import.
AI rationale
The flagged primitives implement documented browser form, chat, attachment, and PDF-preview functionality. Source inspection found no concrete malicious behavior or install-time attack chain.
Evidence
package.jsoncjs/index.jsdist/index.jsdist/fthry_index.DFGpWWz2.jsdist/fthry_AssistantChat.CE0VuFOL.jscjs/fthry_AssistantChat.BtqFl5zJ.js
Network endpoints2
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjscdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.worker.min.mjs
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `dist/fthry_AssistantChat.CE0VuFOL.js` dynamically imports pinned pdfjs from jsDelivr.
- Assistant chat can upload user-selected attachments and index enabled in-form documents to its configured backend.
Evidence against
- `package.json` has no preinstall/install/postinstall hook; `prepare` only invokes Husky.
- Entrypoints `cjs/index.js` and `dist/index.js` load React library code, not install-time payloads.
- The reported Base64 uses convert data URLs and JWT/binary data; no obscured endpoint was found.
- Assistant requests are feature-gated/lazy-loaded and use caller-provided `baseUrl`; no hard-coded exfiltration host.
- No Node filesystem, shell, child-process, persistence, or AI-agent-control writes were found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/fthry_AssistantChat.CE0VuFOL.jsView file
10383// eslint-disable-next-line no-new-func
L10384: var importFromCdn = new Function('url', 'return import(url)');
L10385: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.CE0VuFOL.jsView on unpkg · L10383dist/fthry_index.DGvVJ4-q.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.DGvVJ4-q.jsView on unpkg · L271dist/fthry_index.DFGpWWz2.jsView file
Findings
3 High4 Medium5 Low
HighBrowser Session Account Hijackdist/fthry_index.DFGpWWz2.js
HighBase64 Obscured Urldist/fthry_index.DFGpWWz2.js
HighSemantic Analysis Limitedcjs/fthry_index.Don0GgZd.js
MediumDynamic Requiredist/fthry_index.DGvVJ4-q.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.CE0VuFOL.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.70.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.70.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.