registry / @feathery/react / 2.84.0
@feathery/react@2.84.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe flagged execution primitives implement optional browser feature loading and are not reached during package installation. The package contains expected form and analytics behavior but no concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders configured Feathery forms or invokes optional PDF and QR-scanning features.
Impact
No unconsented install-time execution, credential harvesting, persistence, or destructive behavior was found.
Mechanism
Form-service requests, configured analytics, and optional CDN-loaded browser libraries.
AI rationale
The flagged execution primitives implement optional browser feature loading and are not reached during package installation. The package contains expected form and analytics behavior but no concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has a development prepare hook and a publish-time build hook.
- The browser artifacts load PDF and QR-scanner support from CDNs at runtime.
- The form component can send configured tracking data to analytics integrations.
- The CommonJS artifact uses a local compiled module entrypoint.
Evidence against
- No preinstall, install, or postinstall hook is declared.
- No self-dependency or install-time command execution was found.
- The PDF dynamic import is explicitly a pinned PDF renderer; the UMD artifact contains the same feature.
- Network calls are form, attachment, and configured integration functionality; no secret harvesting or covert exfiltration was found.
- No destructive filesystem action, persistence, or foreign agent-control mutation was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/fthry_AssistantChat.B91Qtk6i.jsView file
10382// eslint-disable-next-line no-new-func
L10383: var importFromCdn = new Function('url', 'return import(url)');
L10384: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.B91Qtk6i.jsView on unpkg · L1038210382// eslint-disable-next-line no-new-func
L10383: var importFromCdn = new Function('url', 'return import(url)');
L10384: var pdfjsPromise = null;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_AssistantChat.B91Qtk6i.jsView on unpkg · L10382dist/fthry_index.AVYedEqz.jsView file
304*/
L305: var from = String.fromCharCode;
L306:
...
L1444:
L1445: if (process.env.NODE_ENV !== "production") {
L1446: (function() {
...
L1795: /* eslint-disable */
L1796: // Inspired by https://github.com/garycourt/murmurhash-js
L1797: // Ported from https://github.[redacted].cpp#L37-L86
...
L5757: * Firefox 143 shipped Phase 2 fingerprinting protections (screen resolution, processor count, touch points)
L5758: * in Private Browsing and ETP Strict mode.
L5759: *
Findings
1 Critical5 High4 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.221055983ce87bd5b610.js
HighChild Process
HighEvaldist/fthry_AssistantChat.B91Qtk6i.js
HighBrowser Session Account Hijackdist/fthry_index.AVYedEqz.js
HighBase64 Obscured Urldist/fthry_index.AVYedEqz.js
HighSemantic Analysis Limitedcjs/fthry_index.Cln4Qf_Z.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_AssistantChat.B91Qtk6i.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @feathery/react@2.84.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.84.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.