registry / @feathery/react / 2.81.0
@feathery/react@2.81.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic review of the manifest and every high-severity flagged file shows a React form widget talking to Feathery and known vendors, with prepare limited to husky and no install hook. Scanner labels such as eval, remote decode-execute, session hijack, and obscured URLs are noisy matches on pdf.js loading, audio atob, FingerprintJS, and datepicker CSS.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A consumer installs the library and imports it to render Feathery forms in a browser app.
Impact
No confirmed malicious impact; form and analytics traffic stay on product-aligned backends when the SDK is used.
Mechanism
Browser form SDK with vendor CDN helpers
AI rationale
Static review of the manifest and every high-severity flagged file shows a React form widget talking to Feathery and known vendors, with prepare limited to husky and no install hook. Scanner labels such as eval, remote decode-execute, session hijack, and obscured URLs are noisy matches on pdf.js loading, audio atob, FingerprintJS, and datepicker CSS.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json scripts include prepare and prepublishOnly, not install-time hooks
- pdf.js is loaded with new Function wrapping import of a jsDelivr ESM URL
- AssistantChat base64-decodes audio chunks and loads VAD and ONNX assets from jsDelivr
- FingerprintJS atob-decodes ad-blocker CSS selectors; form traffic targets Feathery API hosts
- the CJS field bundle is ordinary React requires plus a country-flag font polyfill
- a large datepicker style chunk was added; it is react-datepicker CSS, not a payload
Evidence against
- There is no preinstall, install, or postinstall script; prepare runs husky and prepublishOnly runs yarn build
- No bin entry, no self-dependency, and no child_process or remote-text eval
- Dynamic Function only hides import(url) so bundlers do not rewrite the pdf.js CDN specifier
- atob usage is TTS/audio bytes and FingerprintJS selector strings, not a hidden command-and-control URL
- Network hosts match the Feathery form product plus Stytch, Stripe, Segment, and pinned jsDelivr libraries
Behavioral surface
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.A9Fy73GP.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.A9Fy73GP.jsView on unpkg · L271dist/fthry_index.BGFTWujh.jsView file
Findings
1 Critical5 High4 Medium5 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.221055983ce87bd5b610.js
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackdist/fthry_index.BGFTWujh.js
HighBase64 Obscured Urldist/fthry_index.BGFTWujh.js
HighSemantic Analysis Limitedcjs/fthry_index.7o_p7FiS.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/fthry_index.CDVsm_Id.js
MediumDynamic Requiredist/fthry_index.A9Fy73GP.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @feathery/react@2.81.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.81.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.