registry / @feathery/react / 2.95.0
@feathery/react@2.95.0
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoints contain ordinary browser-library networking with a fixed PDF CDN import and an origin check for link-gated requests. No concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application import and use of the library's form, assistant, or PDF-viewing features.
Impact
No unconsented installation-time action, credential export to an unrestricted endpoint, persistence, or destructive behavior was confirmed.
Mechanism
The code issues feature requests to configured service origins and dynamically imports a pinned PDF.js module.
AI rationale
The inspected entrypoints contain ordinary browser-library networking with a fixed PDF CDN import and an origin check for link-gated requests. No concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata exposes browser library entrypoints and contains no install, preinstall, or postinstall hook.
- The PDF loader dynamically imports a version-pinned PDF.js module from its fixed CDN path.
- The main CommonJS request guard only treats configured API and static-service origins as link-gated.
- The CommonJS request helper sends requests through its configured URL with normal request headers.
- The UMD assistant bundle fetches form-keyed assistant-thread paths derived from its supplied base URL.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.C-aFL9JX.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.C-aFL9JX.jsView on unpkg · L27dist/fthry_index.ydrznWG8.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.ydrznWG8.jsView on unpkg · L3657umd/index.jsView file
1
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.9488eb8eb47e3a826924.js
HighEvaldist/fthry_pdfjsLoader.C-aFL9JX.js
HighBrowser Session Account Hijackumd/index.js
HighBase64 Obscured Urlumd/index.js
HighSemantic Analysis Limitedcjs/fthry_index.BK9sRjNV.js
MediumDynamic Requiredist/fthry_index.ydrznWG8.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.C3gM8L7B.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @feathery/react@2.95.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.95.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.