registry / @feathery/react / 2.72.0
@feathery/react@2.72.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found normal React SDK behavior and package-aligned browser networking. Static signals for Base64 and dynamic code are explained by file conversion/auth helpers and a documented pinned PDF.js import.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders Feathery forms or assistant/document-preview components.
Impact
No unconsented install-time mutation, credential theft, persistence, or remote payload chain was established.
Mechanism
User-invoked browser API calls and PDF preview dependency loading.
AI rationale
Direct inspection found normal React SDK behavior and package-aligned browser networking. Static signals for Base64 and dynamic code are explained by file conversion/auth helpers and a documented pinned PDF.js import.
Evidence
package.jsoncjs/index.jsdist/index.jsdist/fthry_index.CLQBYRpj.jsdist/fthry_AssistantChat.BOeFzKbg.js
Network endpoints2
api.feathery.io/api/cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjs
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- Entrypoints are React library bundles; no install-time payload code found.
- The prepare hook only invokes Husky; prepublishOnly only builds.
- Base64 use decodes user/file and URL-safe binary data, not an obscured endpoint.
- new Function explicitly imports a version-pinned pdf.js module from jsDelivr.
- Network APIs target Feathery service URLs or user-configured form/assistant requests; no credential harvesting or exfiltration chain found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/fthry_AssistantChat.BOeFzKbg.jsView file
10383// eslint-disable-next-line no-new-func
L10384: var importFromCdn = new Function('url', 'return import(url)');
L10385: var pdfjsPromise = null;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/fthry_AssistantChat.BOeFzKbg.jsView on unpkg · L10383dist/fthry_index.4xPnD1Wj.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.4xPnD1Wj.jsView on unpkg · L271dist/fthry_index.CLQBYRpj.jsView file
Findings
3 High4 Medium5 Low
HighBrowser Session Account Hijackdist/fthry_index.CLQBYRpj.js
HighBase64 Obscured Urldist/fthry_index.CLQBYRpj.js
HighSemantic Analysis Limitedcjs/fthry_index.CDDTKeL3.js
MediumDynamic Requiredist/fthry_index.4xPnD1Wj.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/fthry_AssistantChat.BOeFzKbg.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.72.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.72.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.