registry / @feathery/react / 2.77.0
@feathery/react@2.77.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's execution signal corresponds to a transparent, pinned pdf.js CDN import used by a PDF-thumbnail component. Package lifecycle and entrypoint inspection found no install-time execution or concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Rendering a PDF attachment thumbnail in the Assistant UI.
Impact
Loads the declared PDF rendering library; no credential harvesting, host mutation, or unrelated payload chain was found.
Mechanism
Pinned CDN import of pdf.js for PDF rendering.
AI rationale
The scanner's execution signal corresponds to a transparent, pinned pdf.js CDN import used by a PDF-thumbnail component. Package lifecycle and entrypoint inspection found no install-time execution or concrete malicious behavior.
Evidence
package.jsoncjs/index.jsdist/fthry_pdfjsLoader.CRkrFcJY.jsdist/fthry_AssistantChat.DhOtVNl3.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Assistant bundle dynamically imports remote pdfjs code.
Evidence against
- Import is pinned to pdfjs-dist@5.4.296 on jsDelivr.
- It is invoked only by the PDF thumbnail component.
- No install/preinstall/postinstall hook; prepare only invokes Husky.
- Entrypoint imports local bundles and normal React dependencies.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/fthry_AssistantChat.DhOtVNl3.jsView file
10383// eslint-disable-next-line no-new-func
L10384: var importFromCdn = new Function('url', 'return import(url)');
L10385: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.DhOtVNl3.jsView on unpkg · L1038310383// eslint-disable-next-line no-new-func
L10384: var importFromCdn = new Function('url', 'return import(url)');
L10385: var pdfjsPromise = null;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_AssistantChat.DhOtVNl3.jsView on unpkg · L10383dist/fthry_index.CbqSzf8k.jsView file
304*/
L305: var from = String.fromCharCode;
L306:
...
L1444:
L1445: if (process.env.NODE_ENV !== "production") {
L1446: (function() {
...
L1795: /* eslint-disable */
L1796: // Inspired by https://github.com/garycourt/murmurhash-js
L1797: // Ported from https://github.[redacted].cpp#L37-L86
...
L4034: * Firefox 143 shipped Phase 2 fingerprinting protections (screen resolution, processor count, touch points)
L4035: * in Private Browsing and ETP Strict mode.
L4036: *
Findings
1 Critical5 High4 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.f1113aca5a3964831960.js
HighChild Process
HighEvaldist/fthry_AssistantChat.DhOtVNl3.js
HighBrowser Session Account Hijackdist/fthry_index.CbqSzf8k.js
HighBase64 Obscured Urldist/fthry_index.CbqSzf8k.js
HighSemantic Analysis Limitedcjs/fthry_index.O4gM9h8t.js
MediumDynamic Requiredist/fthry_AssistantChat.DhOtVNl3.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feathery/react@2.77.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.77.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.