registry / @feathery/react / 2.88.0
@feathery/react@2.88.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found package-aligned browser functionality rather than a malicious chain. The scanner's dynamic-execution and session findings correspond to PDF loading and authenticated Feathery client requests.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using PDF rendering or the Feathery form client at runtime.
Impact
No unconsented install-time action, local data harvesting, or malicious exfiltration was found.
Mechanism
Pinned PDF module import and authenticated Feathery API requests.
AI rationale
Static inspection found package-aligned browser functionality rather than a malicious chain. The scanner's dynamic-execution and session findings correspond to PDF loading and authenticated Feathery client requests.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The PDF viewer dynamically imports a pinned pdfjs-dist module from jsDelivr at runtime.
- The client reads its own Feathery session cookie and sends it only as a request header to configured Feathery API URLs.
- The manifest contains only prepublish build and prepare hooks; it has no install, preinstall, or postinstall hook.
Evidence against
- No source evidence of filesystem harvesting, shell execution, persistence, or secret exfiltration was found.
- The dynamic import is a package-aligned PDF rendering dependency with a fixed version and host.
- The flagged bundled network code is normal authenticated form-service communication, not account takeover behavior.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.BByaMn6k.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BByaMn6k.jsView on unpkg · L74cjs/fthry_index.CAs4iLky.jsView file
Findings
1 Critical5 High5 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.f564585b8f044e96f031.js
HighChild Process
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackcjs/fthry_index.CAs4iLky.js
HighBase64 Obscured Urlcjs/fthry_index.CAs4iLky.js
HighSemantic Analysis Limitedcjs/fthry_index.CAs4iLky.js
MediumDynamic Requiredist/fthry_index.BByaMn6k.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.DKovcy_F.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @feathery/react@2.88.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.88.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.