registry / @feathery/react / 2.71.0
@feathery/react@2.71.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic source inspection found no concrete malicious chain or install-time execution. Scanner signals map to documented PDF.js dynamic import, hosted Feathery APIs, and explicit custom-component behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Application runtime usage or explicit custom-component configuration.
Impact
No credential harvesting, exfiltration, persistence, destructive action, or install-time mutation was established.
Mechanism
Hosted-form API access and user-configured browser component loading.
AI rationale
Static source inspection found no concrete malicious chain or install-time execution. Scanner signals map to documented PDF.js dynamic import, hosted Feathery APIs, and explicit custom-component behavior.
Evidence
package.jsondist/fthry_index.BDi0hfL7.jsdist/fthry_index.7w1XP0g7.jsdist/fthry_index.DpYm8MJp.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Lifecycle scripts are build/prepublish tooling and Husky; no install/postinstall payload is defined.
- API configuration names Feathery-owned service endpoints.
- `new Function` is documented and limited to a pinned jsDelivr PDF.js dynamic import.
- The custom-component loader derives imports from supplied component code, not hidden package data.
Evidence against
- Browser runtime includes network, storage, and authentication SDK functionality expected of a hosted form library.
- Custom components can explicitly request external imports, a user-configured capability rather than a covert payload.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/fthry_index.7w1XP0g7.jsView file
31// shadows the wrapper's own binding and crashes module evaluation). Loading
L32: // it as a real ES module via dynamic `import()` at runtime sidesteps that
L33: // entirely, and keeps pdf.js out of every consumer's bundle.
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.7w1XP0g7.jsView on unpkg · L3146// eslint-disable-next-line no-new-func
L47: var dynamicImport = new Function('u', 'return import(u)');
L48: function loadPdfjs() {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_index.7w1XP0g7.jsView on unpkg · L46dist/fthry_index.BDi0hfL7.jsView file
304*/
L305: var from = String.fromCharCode;
L306:
...
L1444:
L1445: if (process.env.NODE_ENV !== "production") {
L1446: (function() {
...
L1795: /* eslint-disable */
L1796: // Inspired by https://github.com/garycourt/murmurhash-js
L1797: // Ported from https://github.[redacted].cpp#L37-L86
...
L4034: * Firefox 143 shipped Phase 2 fingerprinting protections (screen resolution, processor count, touch points)
L4035: * in Private Browsing and ETP Strict mode.
L4036: *
Findings
3 High4 Medium5 Low
HighBrowser Session Account Hijackdist/fthry_index.BDi0hfL7.js
HighBase64 Obscured Urldist/fthry_index.BDi0hfL7.js
HighSemantic Analysis Limitedcjs/fthry_index.DCL4YfOc.js
MediumDynamic Requiredist/fthry_index.7w1XP0g7.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_index.7w1XP0g7.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.71.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.71.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.