registry / @feathery/react / 2.80.0
@feathery/react@2.80.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found package-aligned browser SDK behavior, including a pinned PDF CDN import and Feathery API authentication headers. The scanner's execution/network indicators do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Runtime use of Feathery form, assistant, or PDF-viewing features.
Impact
No install-time mutation, credential harvesting, shell execution, persistence, or destructive behavior observed.
Mechanism
Feathery API requests and pinned CDN module loading.
AI rationale
Static inspection found package-aligned browser SDK behavior, including a pinned PDF CDN import and Feathery API authentication headers. The scanner's execution/network indicators do not establish malicious behavior.
Evidence
package.jsoncjs/fthry_pdfjsLoader.CjJm-Y3u.jscjs/fthry_AssistantChat.DVjhdrPE.jscjs/fthry_index.CqLs8erG.jscjs/index.js
Network endpoints3
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296api.feathery.io/api/staging.feathery.io/api/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Runtime dynamically imports pinned pdfjs-dist from jsDelivr.
- Runtime API helper reads a Feathery session cookie and attaches it to requests.
Evidence against
- No preinstall, install, or postinstall lifecycle hook; prepare only runs husky.
- Entrypoint only imports bundled React library modules.
- Remote import is a fixed PDF renderer URL, not decoded or attacker-selected payload.
- Configured API hosts are Feathery service endpoints; no local harvesting, shell execution, or persistence was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.D3iZxvlQ.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.D3iZxvlQ.jsView on unpkg · L74dist/fthry_index.iIgR7IWG.jsView file
Findings
1 Critical6 High4 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.221055983ce87bd5b610.js
HighChild Process
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackdist/fthry_index.iIgR7IWG.js
HighBase64 Obscured Urldist/fthry_index.iIgR7IWG.js
HighSemantic Analysis Limitedcjs/fthry_index.CqLs8erG.js
HighPrevious Version Dangerous Deltadist/fthry_index.iIgR7IWG.js
MediumDynamic Requiredist/fthry_index.D3iZxvlQ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @feathery/react@2.80.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.80.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.