registry / @feathery/react / 2.82.1
@feathery/react@2.82.1
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiScanner labels matched bundled pdf.js import, FingerprintJS, ONNX voice-activity code, and audio base64 decode inside a normal Feathery React SDK. There is no install-time mutation or concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An application installs the package from the npm registry and renders Feathery form or assistant components.
Impact
No confirmed supply-chain attack; integrating apps talk to Feathery and listed third-party widgets.
Mechanism
User-invoked React form and assistant SDK
AI rationale
Scanner labels matched bundled pdf.js import, FingerprintJS, ONNX voice-activity code, and audio base64 decode inside a normal Feathery React SDK. There is no install-time mutation or concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- PDF viewer loads pdfjs-dist from jsdelivr with new Function wrapping import.
- Assistant chat decodes base64 into audio bytes for playback.
- Bundled FingerprintJS uses atob on ad-block selectors and probes google.com/generate_204.
- Voice-activity code dynamically imports a same-origin ONNX worker blob.
- A newly added chunk is react-datepicker UI, not a payload.
- A large CJS file the scanner could not fully analyze is a country-flag font polyfill and timezone tables.
Evidence against
- No preinstall, install, or postinstall scripts; prepare is husky and prepublishOnly is yarn build.
- Manifest describes a React Feathery form library and publishes only dist, cjs, and umd.
- Network use matches Feathery APIs and declared integrations such as Stripe, Stytch, and analytics.
- FingerprintJS, VAD, pdf.js, and audio decode match listed dependencies and product features.
- No obfuscated malware, secret theft, self-dependency install chain, or agent-config writes.
Behavioral surface
DynamicRequireEnvironmentVars
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.CxXw8k-7.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.CxXw8k-7.jsView on unpkg · L271dist/fthry_index.Cr1qIpmh.jsView file
Findings
1 Critical5 High4 Medium5 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.221055983ce87bd5b610.js
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackdist/fthry_index.Cr1qIpmh.js
HighBase64 Obscured Urldist/fthry_index.Cr1qIpmh.js
HighSemantic Analysis Limitedcjs/fthry_index.Xvn24yQd.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/fthry_index.A1_UzCJe.js
MediumDynamic Requiredist/fthry_index.CxXw8k-7.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @feathery/react@2.82.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.82.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.