registry / @feathery/react / 2.91.0
@feathery/react@2.91.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's remote-execution signal is explained by a transparent, pinned pdf.js loader for a user-facing PDF feature. The package has no registry-install lifecycle hook or concrete malicious behavior in the inspected sources.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders Assistant Chat and opens a PDF thumbnail.
Impact
It downloads third-party browser code for PDF rendering; no unconsented local mutation or exfiltration was found.
Mechanism
Dynamic import of pinned pdf.js rendering code.
AI rationale
The scanner's remote-execution signal is explained by a transparent, pinned pdf.js loader for a user-facing PDF feature. The package has no registry-install lifecycle hook or concrete malicious behavior in the inspected sources.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The Assistant Chat feature dynamically imports a pinned pdf.js module from jsDelivr at runtime.
- The browser bundle contains Feathery API configuration and bundled authentication-provider code.
- The CommonJS entry only loads the package runtime bundle.
Evidence against
- There is no preinstall, install, or postinstall lifecycle hook.
- The remote import is confined to PDF thumbnail support and explicitly sets the matching PDF worker.
- No source evidence showed credential harvesting, shell execution, project-file mutation, persistence, or data exfiltration.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_AssistantChat.CIzTO9qp.jsView file
10382// eslint-disable-next-line no-new-func
L10383: var importFromCdn = new Function('url', 'return import(url)');
L10384: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.CIzTO9qp.jsView on unpkg · L10382dist/fthry_index.BOXCSBw4.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BOXCSBw4.jsView on unpkg · L3657cjs/fthry_index.X_N8uDYR.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ec70bb6307bcd95f409c.js
HighEvaldist/fthry_AssistantChat.CIzTO9qp.js
HighBrowser Session Account Hijackcjs/fthry_index.X_N8uDYR.js
HighBase64 Obscured Urlcjs/fthry_index.X_N8uDYR.js
HighSemantic Analysis Limitedcjs/fthry_index.BOr1o6vA.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.BOXCSBw4.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.BP7TBqEi.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.91.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.91.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.