@dori-ai/dori-side-widget
A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
This report shows the evidence for @dori-ai/dori-side-widget@1.13.174. 0 of 91 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package manifest has no install hooks, and the inspected runtime requests send widget and Shopify context to Dori’s service for chat and commerce features. I found no evidence of unrelated credential collection, account mutation, or an external collector.
Decision evidence
public snapshot- The manifest points to dist/widget.js and declares no lifecycle scripts or dependencies.
- The widget uses Dori’s standardapi.dori.tech service for its API requests.
- On Shopify storefronts, the widget requests a customer token from a same-origin /apps/dori/customer-token route and includes it in the assistant request.
- Product and session tracking sends widget-related IDs and product data to Dori API endpoints.
- The provider reads a Shopify customer ID and may send customer email or ID with product-view tracking.
- The widget sends chat messages and related context to the assistant service as part of its advertised chat feature.
Source & flagged code
6 flaggedPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/assets/provider-9Wh21Ch_.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.174.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.174 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.