@feathery/react@2.92.0
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe behavior is a concrete remote-code loading surface, though the fixed pdfjs-dist URL and viewer-specific use do not establish malicious intent. No install-time attack or credential harvesting was found in the inspected sources.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders a PDF attachment or document viewer.
Impact
A compromised or unavailable CDN artifact could run code in the consumer's browser context.
Mechanism
Dynamic Function-based import from jsDelivr.
AI rationale
The behavior is a concrete remote-code loading surface, though the fixed pdfjs-dist URL and viewer-specific use do not establish malicious intent. No install-time attack or credential harvesting was found in the inspected sources.
Evidence
cjs/fthry_pdfjsLoader.B8yQPtlV.js
Network endpoints1
cdn.jsdelivr.net
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package constructs a CDN URL and uses Function to dynamically import and execute a remote JavaScript module at runtime.
Evidence against
- There are no preinstall, install, or postinstall hooks; prepare only invokes Husky.
- The remote module is a version-pinned pdfjs-dist dependency used by the document viewer, not an opaque payload.
- The inspected assistant requests use the supplied Feathery base URL for chat and document features.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_AssistantChat.61JvK9dg.jsView file
10382// eslint-disable-next-line no-new-func
L10383: var importFromCdn = new Function('url', 'return import(url)');
L10384: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.61JvK9dg.jsView on unpkg · L10382dist/fthry_index.DBSCDDSz.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.DBSCDDSz.jsView on unpkg · L3657umd/index.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.21b2f29725473cecfc9f.js
HighEvaldist/fthry_AssistantChat.61JvK9dg.js
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlumd/index.js
HighSemantic Analysis Limitedcjs/fthry_index.CKvMlzpH.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.DBSCDDSz.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.CZxC5QqU.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.92.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.92.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.