registry / @feathery/react / 2.96.0
@feathery/react@2.96.0
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic review shows a Feathery React SDK whose cited chunks are ordinary library and chat UI code, with no registry install hook or shell execution. The formula comment and bundle imports match a form product, so the package is clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No install-time or import-time attack trigger was found.
Impact
No credential theft, remote payload execution, persistence, or agent control-surface mutation was established.
Mechanism
Bundles load React UI, form helpers, and an allowlisted formula parser that avoids eval and Function.
AI rationale
Static review shows a Feathery React SDK whose cited chunks are ordinary library and chat UI code, with no registry install hook or shell execution. The formula comment and bundle imports match a form product, so the package is clean.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies @feathery/react 2.96.0 as a React form library with cjs and dist entrypoints and no preinstall, install, or postinstall scripts.
- cjs/fthry_index.D8mhJ4kB.js is a library bundle that loads React, JSX runtime, JSZip, and React DOM, and its formula path builds an AST without eval or Function.
- dist/fthry_AssistantChat.DBrKaQX7.js is an ESM assistant-chat chunk that imports the shared index and the Vercel AI SDK error type.
- umd/AssistantChat.ffe51618203f111a02c8.js is a webpackChunkFeathery UI chunk for the same chat widget.
- cjs/fthry_index.6ietgrcW.js only re-exports prop-types and react-is beside the main index chunk.
Evidence against
- Registry install hooks, child_process, and self-dependency install chains are absent.
- Searches of the cited bundles found no eval call and no shell execution.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
7 flaggeddist/fthry_AssistantChat.DBrKaQX7.jsView file
10388// eslint-disable-next-line no-new-func
L10389: var importFromCdn = new Function('url', 'return import(url)');
L10390: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.DBrKaQX7.jsView on unpkg · L10388dist/fthry_index.CAY_iCj0.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.CAY_iCj0.jsView on unpkg · L271cjs/fthry_index.D8mhJ4kB.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_AssistantChat.DBrKaQX7.js
HighBrowser Session Account Hijackcjs/fthry_index.D8mhJ4kB.js
HighBase64 Obscured Urlcjs/fthry_index.D8mhJ4kB.js
HighSemantic Analysis Limitedcjs/fthry_index.6ietgrcW.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.CAY_iCj0.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.DlExjo82.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.96.0.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.96.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.