registry / @feathery/react / 2.90.0
@feathery/react@2.90.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found no registry-install lifecycle hook or concrete malicious behavior. The scanner's evaluation and session findings map to a pinned PDF renderer import and normal Feathery browser application functionality.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Rendering an assistant attachment that requires PDF support.
Impact
Loads the pinned pdf.js module in the browser; no package-driven credential theft, persistence, or install-time mutation was found.
Mechanism
Fixed CDN import of the pdf.js renderer.
AI rationale
Static inspection found no registry-install lifecycle hook or concrete malicious behavior. The scanner's evaluation and session findings map to a pinned PDF renderer import and normal Feathery browser application functionality.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The assistant bundle dynamically imports a version-pinned pdf.js module from a public CDN.
- The UMD assistant artifact contains the same dynamic-import helper.
- The main CJS bundle contains product API endpoint configuration and authenticated request handling.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its publish hook only builds the package.
- The dynamic import is narrowly used for pdf.js rendering, with a fixed CDN version and worker URL.
- Network calls are application features directed to Feathery service endpoints or the pinned pdf.js CDN.
- The CJS entry uses ordinary static requires; no import-time shell execution, filesystem harvesting, or persistence was found.
- Cookie and session-related code supports browser form authentication rather than collecting and exporting credentials.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
7 flaggeddist/fthry_AssistantChat.Cse9oDmH.jsView file
10382// eslint-disable-next-line no-new-func
L10383: var importFromCdn = new Function('url', 'return import(url)');
L10384: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.Cse9oDmH.jsView on unpkg · L10382dist/fthry_index.nHM451Zz.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.nHM451Zz.jsView on unpkg · L271cjs/fthry_index.hemJh9Q3.jsView file
Findings
1 Critical5 High5 Medium5 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ec70bb6307bcd95f409c.js
HighChild Process
HighEvaldist/fthry_AssistantChat.Cse9oDmH.js
HighBrowser Session Account Hijackcjs/fthry_index.hemJh9Q3.js
HighBase64 Obscured Urlcjs/fthry_index.hemJh9Q3.js
HighSemantic Analysis Limitedcjs/fthry_index.BgN4wO-A.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.nHM451Zz.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.BTCzgm_q.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @feathery/react@2.90.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.90.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.