@feathery/react@2.89.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious behavior was confirmed, but runtime execution of a remotely served JavaScript module without integrity verification remains an unresolved security risk. The scanner's claimed decoded-payload behavior was not supported by the inspected decode path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders functionality that loads the PDF helper or assistant attachment PDF support.
Impact
A compromised remote asset could execute in the consuming application's browser origin.
Mechanism
Dynamic import of remotely hosted JavaScript.
AI rationale
No concrete malicious behavior was confirmed, but runtime execution of a remotely served JavaScript module without integrity verification remains an unresolved security risk. The scanner's claimed decoded-payload behavior was not supported by the inspected decode path.
Evidence
dist/fthry_pdfjsLoader.CRkrFcJY.jsumd/AssistantChat.f564585b8f044e96f031.js
Network endpoints1
cdn.jsdelivr.net
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The browser bundles construct dynamic imports for JavaScript served from a remote CDN.
- The remotely imported pdf.js code is not integrity-pinned in the package artifact.
Evidence against
- package.json has no npm preinstall, install, or postinstall hook.
- The prepare hook is a Husky development hook, while prepublishOnly only builds the package.
- The observed Base64 decode is for audio bytes, not decoded code execution.
- No credential harvesting, filesystem access, shell execution, or covert endpoint was confirmed.
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.B2c1W0ze.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.B2c1W0ze.jsView on unpkg · L271umd/index.jsView file
Findings
1 Critical4 High5 Medium5 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.f564585b8f044e96f031.js
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlumd/index.js
HighSemantic Analysis Limitedcjs/fthry_index.B6NtN44O.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.B2c1W0ze.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.BtN7xBNs.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @feathery/react@2.89.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.89.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.