registry / @feathery/react / 2.79.0
@feathery/react@2.79.0
React library for Feathery
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's dynamic-evaluation finding is a documented lazy ESM import of a version-pinned PDF.js CDN dependency, not decoded remote payload execution. Source inspection found no install-time attack, exfiltration, persistence, filesystem mutation, or agent-control behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime PDF-viewer or attachment use.
Impact
Loads third-party PDF.js code in the consumer browser; no local persistence, credential collection, or destructive behavior was found.
Mechanism
Lazy dynamic import of pinned PDF.js CDN assets.
AI rationale
The scanner's dynamic-evaluation finding is a documented lazy ESM import of a version-pinned PDF.js CDN dependency, not decoded remote payload execution. Source inspection found no install-time attack, exfiltration, persistence, filesystem mutation, or agent-control behavior.
Evidence
package.jsoncjs/index.jscjs/fthry_pdfjsLoader.CjJm-Y3u.jscjs/fthry_AssistantChat.DO2KqHQm.js
Network endpoints2
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.min.mjscdn.jsdelivr.net/npm/pdfjs-dist@5.4.296/build/pdf.worker.min.mjs
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime code dynamically imports a pinned pdf.js module from jsDelivr.
Evidence against
- The import is in a lazy loader, not an install hook.
- Manifest has only prepare (husky) and prepublishOnly; no install/postinstall script.
- Entrypoint only imports bundled React library modules.
- Base64 use converts audio data to bytes; no decoded payload execution found.
- No credential harvesting, filesystem writes, child-process use, or agent-control mutation found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.7arEWv6E.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.7arEWv6E.jsView on unpkg · L271dist/fthry_index.BRHeKs5n.jsView file
Findings
1 Critical5 High4 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.221055983ce87bd5b610.js
HighChild Process
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackdist/fthry_index.BRHeKs5n.js
HighBase64 Obscured Urldist/fthry_index.BRHeKs5n.js
HighSemantic Analysis Limitedcjs/fthry_index.2l8g05cR.js
MediumDynamic Requiredist/fthry_index.7arEWv6E.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @feathery/react@2.79.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.79.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.