registry / @feathery/react / 2.87.0
@feathery/react@2.87.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk detections resolve to normal bundled browser functionality: a pinned PDF renderer import, authenticated SDK requests, and base64 byte handling. The package has no automatic registry install hook or concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Using Feathery form or assistant features, including PDF rendering.
Impact
No concrete unauthorized execution, persistence, credential theft, or exfiltration was found.
Mechanism
Authenticated Feathery API requests and a pinned PDF.js dynamic import.
AI rationale
The high-risk detections resolve to normal bundled browser functionality: a pinned PDF renderer import, authenticated SDK requests, and base64 byte handling. The package has no automatic registry install hook or concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares a publication build hook, not a preinstall, install, or postinstall hook.
- The PDF loader dynamically imports a pinned pdfjs module from jsDelivr at runtime.
- The main browser bundle reads a Feathery session cookie and sends it as an API request header.
- The semantic-limit artifact is a CommonJS bundle that imports the primary implementation.
- The AssistantChat artifact decodes base64 chunks into byte arrays for a queued segment.
- The reported new artifact starts with ordinary React and UI module imports.
Evidence against
- No automatic registry install hook or self-dependency was found.
- The PDF import is a visible, version-pinned dependency load for PDF rendering.
- The AssistantChat base64 operation creates bytes and queues them; it does not evaluate decoded content.
- The cookie use is explicit SDK authentication for the request URL, not collection sent to an unrelated endpoint.
- No source evidence established credential harvesting, shell execution, persistence, destructive behavior, or covert exfiltration.
Behavioral surface
Source & flagged code
8 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.DJmDb7d6.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.DJmDb7d6.jsView on unpkg · L74cjs/fthry_index.HksJlkZD.jsView file
Findings
1 Critical6 High5 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.f564585b8f044e96f031.js
HighChild Process
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackcjs/fthry_index.HksJlkZD.js
HighBase64 Obscured Urlcjs/fthry_index.HksJlkZD.js
HighSemantic Analysis Limitedcjs/fthry_index.BQfWiq8q.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/fthry_index.DluVYmv-.js
MediumDynamic Requiredist/fthry_index.DJmDb7d6.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.BVP91_lx.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @feathery/react@2.87.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.87.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.