registry / @feathery/react / 2.98.1
@feathery/react@2.98.1
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection shows a Feathery React SDK whose scripts, entrypoints, and cited chunks implement form and assistant behavior against Feathery hosts. No install hook, hidden exfiltration, or foreign agent-control write was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No install-time or import-time attack trigger was found. Network calls occur when application code uses the form or assistant features.
Impact
No credential theft, remote payload execution, persistence, or unconsented agent-control mutation was established from the inspected entry and chunk files.
Mechanism
Scripts do not run on registry install. Assistant requests go to /agent/threads/ on the configured Feathery base URL using caller headers and form_key.
AI rationale
Static inspection shows a Feathery React SDK whose scripts, entrypoints, and cited chunks implement form and assistant behavior against Feathery hosts. No install hook, hidden exfiltration, or foreign agent-control write was found.
Network endpoints2
api.feathery.io/api/staging.feathery.io/api/
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json names @feathery/react 2.98.1 as a Feathery React library and defines prepublishOnly and test scripts, with no preinstall, install, or postinstall hook.
- The dist assistant chunk builds product chat URLs under /agent/threads/ on a caller-supplied base URL and adds form_key for form session checks.
- The shared runtime maps environments to Feathery API hosts such as localhost, staging.feathery.io, and api.feathery.io.
- The UMD assistant chunk requests the same /agent/threads/ path with caller-provided headers and a form_key query.
- The cited phone-field chunk loads country-flag emoji fonts for the phone input UI.
Evidence against
- prepare runs husky only as a publish-time or local git-hook helper, and husky is a devDependency not shipped in the published files list.
- Hashed fthry_ and UMD chunk names are bundler output of the form library, not a second install payload.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
7 flaggeddist/fthry_AssistantChat.BRUlODFL.jsView file
10388// eslint-disable-next-line no-new-func
L10389: var importFromCdn = new Function('url', 'return import(url)');
L10390: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.BRUlODFL.jsView on unpkg · L10388dist/fthry_index.1QBYZDbB.jsView file
3657try {
L3658: var util = require('util');
L3659: /* istanbul ignore next */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.1QBYZDbB.jsView on unpkg · L3657cjs/fthry_index.DsNIEoiL.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_AssistantChat.BRUlODFL.js
HighBrowser Session Account Hijackcjs/fthry_index.DsNIEoiL.js
HighBase64 Obscured Urlcjs/fthry_index.DsNIEoiL.js
HighSemantic Analysis Limitedcjs/fthry_index.B3u8SQtw.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.1QBYZDbB.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.C4Sjt5Dh.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.98.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.98.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.