registry / @feathery/react / 2.82.0
@feathery/react@2.82.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic review shows a commercial Feathery React client with no install hooks that mutate the host, no self-dependency chain, and no decoded remote payload execution. High scanner labels map to pdf.js loading, FingerprintJS, form cookies, and a datepicker bundle.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A consuming app installs the library and renders Feathery forms or the assistant UI.
Impact
No confirmed malicious impact beyond normal form, auth, analytics, and document-viewer behavior.
Mechanism
Package-aligned form SDK networking and optional CDN pdf.js import
AI rationale
Static review shows a commercial Feathery React client with no install hooks that mutate the host, no self-dependency chain, and no decoded remote payload execution. High scanner labels map to pdf.js loading, FingerprintJS, form cookies, and a datepicker bundle.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- prepare and prepublishOnly scripts exist, but they are husky and yarn build, not install hooks.
- PDF loader uses new Function only to dynamically import pinned pdf.js from jsdelivr.
- Assistant chat uses the same CDN import helper and atob on audio bytes.
- Main bundle includes FingerprintJS Base64 CSS selectors, cookie helpers, and Feathery API URLs.
- CJS entry re-exports the form SDK and regional api.feathery.io hosts.
- A large datepicker chunk is new versus a prior stored version.
Evidence against
- No preinstall, install, or postinstall scripts; published files are dist, cjs, and umd.
- Network targets are Feathery APIs/CDNs plus form integrations such as pdfjs-dist on jsdelivr.
- new Function only returns import(u) for a version-pinned pdf.min.mjs URL.
- atob is used for FingerprintJS ad-block selectors, image data URLs, and voice audio, not to run decoded code.
- Cookie reads are named SDK session helpers, not a hidden account-takeover path.
- No self-dependency, child_process, eval, or install-time agent/config mutation.
Behavioral surface
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.BVBhmTvz.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BVBhmTvz.jsView on unpkg · L271dist/fthry_index.CZgo9XWX.jsView file
Findings
1 Critical5 High4 Medium5 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.221055983ce87bd5b610.js
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackdist/fthry_index.CZgo9XWX.js
HighBase64 Obscured Urldist/fthry_index.CZgo9XWX.js
HighSemantic Analysis Limitedcjs/fthry_index.4xhV1RA6.js
HighPrevious Version Dangerous Deltadist/fthry_index.BS9uPpIi.js
MediumDynamic Requiredist/fthry_index.BVBhmTvz.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @feathery/react@2.82.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.82.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.