registry / @feathery/react / 2.86.1
@feathery/react@2.86.1
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's execution finding is a constrained, version-pinned PDF.js import, not a decoded remote payload. The package has no automatic registry install hook or concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders PDF-related functionality.
Impact
No install-time execution, credential harvesting, or host mutation was found.
Mechanism
Pinned runtime import of PDF.js and internal lazy component loading.
AI rationale
The scanner's execution finding is a constrained, version-pinned PDF.js import, not a decoded remote payload. The package has no automatic registry install hook or concrete malicious behavior.
Network endpoints1
cdn.jsdelivr.net
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The browser bundle dynamically imports PDF.js from a fixed jsDelivr URL.
- The assistant component is loaded lazily from an internal package chunk.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The only prepare hook invokes Husky; it is not a registry install hook.
- The PDF import is pinned to pdfjs-dist version 5.4.296 and is used to load its worker.
- Dynamic requires name local bundled chunks, not attacker-controlled modules.
- No child-process, credential harvesting, or project-file mutation was found in inspected code.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.COz8H14Y.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.COz8H14Y.jsView on unpkg · L3657cjs/fthry_index.CQKQg-Rm.jsView file
Findings
1 Critical5 High5 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.84dc89c4fc9b88fe2007.js
HighChild Process
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackcjs/fthry_index.CQKQg-Rm.js
HighBase64 Obscured Urlcjs/fthry_index.CQKQg-Rm.js
HighSemantic Analysis Limitedcjs/fthry_index.CQKQg-Rm.js
MediumDynamic Requiredist/fthry_index.COz8H14Y.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.D2HBEt0N.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @feathery/react@2.86.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.86.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.