registry / @feathery/react / 2.78.0
@feathery/react@2.78.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk scanner matches resolve to ordinary browser library functionality: dynamic PDF loading and Base64 media/data-URL conversion. No lifecycle trigger or concrete malicious data flow was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A consuming application renders the relevant PDF or assistant/form feature.
Impact
No unconsented installation action, credential exfiltration, destructive action, or remote payload execution was established.
Mechanism
The PDF helper dynamically imports a pinned pdfjs-dist module; the flagged Base64 code converts data URLs or audio chunks to bytes.
AI rationale
The high-risk scanner matches resolve to ordinary browser library functionality: dynamic PDF loading and Base64 media/data-URL conversion. No lifecycle trigger or concrete malicious data flow was found.
Network endpoints1
cdn.jsdelivr.net
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes browser and CommonJS library entrypoints and has no install, preinstall, or postinstall hook.
- The PDF loader pins a pdfjs-dist CDN version and loads that module only through its loader function.
- The flagged Base64 use converts a caller-supplied data URL into a File for thumbnail handling.
- The AssistantChat bundle decodes streamed chunks into bytes; the excerpt contains no evaluation or execution sink.
- The CommonJS flagged file implements browser canvas/font feature detection.
Evidence against
- Remote PDF module loading from jsDelivr is a supply-chain dependency, but it is pinned and limited to the PDF viewer loader.
- The package contains normal form-submission and assistant API functionality, but inspection found no credential harvesting, unrelated recipient, or automatic execution path.
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.B3lh27Wi.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.B3lh27Wi.jsView on unpkg · L271dist/fthry_index.D-FwPypr.jsView file
Findings
1 Critical5 High4 Medium5 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.afd7a9e05b3798813e71.js
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackdist/fthry_index.D-FwPypr.js
HighBase64 Obscured Urldist/fthry_index.D-FwPypr.js
HighSemantic Analysis Limitedcjs/fthry_index.BIHrCoNs.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/fthry_index.D-FwPypr.js
MediumDynamic Requiredist/fthry_index.B3lh27Wi.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @feathery/react@2.78.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.78.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.