registry / @feathery/react / 2.99.1
@feathery/react@2.99.1
React library for Feathery
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected package is a React SDK with conventional entrypoints and package-aligned browser networking. Its dynamic PDF.js import is tied to a fixed, version-pinned CDN dependency, while sensitive link headers are origin-gated.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing and using the React package can initialize its application components; PDF rendering activates the fixed PDF.js loader.
Impact
No confirmed credential theft, arbitrary remote endpoint selection, install-time attack, persistence, or destructive behavior was found.
Mechanism
The bundles use normal module imports, backend-origin-gated request headers, and a version-pinned PDF.js CDN path.
AI rationale
The inspected package is a React SDK with conventional entrypoints and package-aligned browser networking. Its dynamic PDF.js import is tied to a fixed, version-pinned CDN dependency, while sensitive link headers are origin-gated.
Network endpoints1
cdn.jsdelivr.net/npm/pdfjs-dist@5.4.296
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package declares standard CommonJS and ES module entrypoints.
- The assistant bundle constructs fixed PDF.js module and worker paths.
- Request headers are sent only when the destination matches configured backend origins.
- The UMD file is a bundled module that registers a default export.
- The smaller CommonJS bundle imports local components and React.
Evidence against
- The assistant bundle contains a dynamic import mechanism for its PDF.js CDN dependency.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/fthry_AssistantChat.B2O3McAF.jsView file
10388// eslint-disable-next-line no-new-func
L10389: var importFromCdn = new Function('url', 'return import(url)');
L10390: var pdfjsPromise = null;
High
Eval
Package source references dynamic code evaluation.
dist/fthry_AssistantChat.B2O3McAF.jsView on unpkg · L10388dist/fthry_index.Dje5uBj7.jsView file
271L272: function commonjsRequire(path) {
L273: throw new Error('Could not dynamically require "' + path + '". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriate...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.Dje5uBj7.jsView on unpkg · L271cjs/fthry_index.YDejKQai.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.ffe51618203f111a02c8.js
HighEvaldist/fthry_AssistantChat.B2O3McAF.js
HighBrowser Session Account Hijackcjs/fthry_index.YDejKQai.js
HighBase64 Obscured Urlcjs/fthry_index.YDejKQai.js
HighSemantic Analysis Limitedcjs/fthry_index.DS5-4KO-.js#virtual:normalized:round1
MediumDynamic Requiredist/fthry_index.Dje5uBj7.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.lQ-kfd4a.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @feathery/react@2.99.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.99.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.