registry / @dori-ai/dori-side-widget / 1.13.109

@dori-ai/dori-side-widget@1.13.109

⚠ Under review

A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The readable entry and chunk behave as a vendor chat widget with no install hook. A required path, dist/widget.js.gz, is binary and cannot be cited, so the review cannot be finalized as clean.

Static reason

No blocking static signals were detected.

Trigger

Citation of dist/widget.js.gz fails because the file is binary. Nothing in package.json runs at install time.

Impact

No confirmed compromise was established from readable code, and the gzip contents remain unverified.

Mechanism

The UTF-8 bundles import a local chunk and call the vendor API plus analytics. The gzip sibling has no inspectable plaintext logic.

AI rationale

The readable entry and chunk behave as a vendor chat widget with no install hook. A required path, dist/widget.js.gz, is binary and cannot be cited, so the review cannot be finalized as clean.

Evidence

dist/widget.js.gz

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json publishes a public ESM browser entry at dist/widget.js and has no install scripts, bin, or dependencies.
The loader exports https://standardapi.dori.tech, and the main chunk imports that binding as the base for assistant, stream, cart, upload, and tracking routes.
Browser analytics initializes against https://us.i.posthog.com with autocapture and pageview capture disabled.
dist/widget.js.gz is non-UTF8, and cite_source rejected a printable excerpt, so the required clean citation set cannot be completed.

Evidence against

Readable widget and chunk source only load a local Vite chunk after the page includes the script.
A failed dynamic import retries a .js URL taken from the error text, which is a chunk-load retry rather than an installer.
No child_process, eval, credential harvest, or agent-config writes appeared in the readable sources.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

1const va="https://standardapi.dori.tech",fa=["pointerdown","keydown"],ma=["point

Low

Ai Review Evidence

The loader exports https://standardapi.dori.tech, and the main chunk imports that binding as the base for assistant, stream, cart, upload, and tracking routes.

dist/widget.jsView on unpkg · L1

dist/assets/main-BVqvz_hf.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MarkdownContent-zTsknNBD.js","../widget.js"])))=>i.map(i=>d[i]); L2: import{l as e,h as t,A as r,w as n,a,c as o,g as i,s,i as l,S as c,b as u,u as d,d as p,e as f,f as m,j as g,k as h,m as b,n as v,o as y,p as k,q as x,r as w,t as S,v as C,x as z,y...

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/assets/main-BVqvz_hf.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidencedist/widget.js

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.109.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.109 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:33:55.122Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @dori-ai/dori-side-widget / 1.13.109

@dori-ai/dori-side-widget@1.13.109

⚠ Under review

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The readable entry and chunk behave as a vendor chat widget with no install hook. A required path, dist/widget.js.gz, is binary and cannot be cited, so the review cannot be finalized as clean.

Static reason

No blocking static signals were detected.

Trigger

Citation of dist/widget.js.gz fails because the file is binary. Nothing in package.json runs at install time.

Impact

No confirmed compromise was established from readable code, and the gzip contents remain unverified.

Mechanism

The UTF-8 bundles import a local chunk and call the vendor API plus analytics. The gzip sibling has no inspectable plaintext logic.

AI rationale

The readable entry and chunk behave as a vendor chat widget with no install hook. A required path, dist/widget.js.gz, is binary and cannot be cited, so the review cannot be finalized as clean.

Evidence

dist/widget.js.gz

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json publishes a public ESM browser entry at dist/widget.js and has no install scripts, bin, or dependencies.
The loader exports https://standardapi.dori.tech, and the main chunk imports that binding as the base for assistant, stream, cart, upload, and tracking routes.
Browser analytics initializes against https://us.i.posthog.com with autocapture and pageview capture disabled.
dist/widget.js.gz is non-UTF8, and cite_source rejected a printable excerpt, so the required clean citation set cannot be completed.

Evidence against

Readable widget and chunk source only load a local Vite chunk after the page includes the script.
A failed dynamic import retries a .js URL taken from the error text, which is a chunk-load retry rather than an installer.
No child_process, eval, credential harvest, or agent-config writes appeared in the readable sources.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

1const va="https://standardapi.dori.tech",fa=["pointerdown","keydown"],ma=["point

Low

Ai Review Evidence

The loader exports https://standardapi.dori.tech, and the main chunk imports that binding as the base for assistant, stream, cart, upload, and tracking routes.

dist/widget.jsView on unpkg · L1

dist/assets/main-BVqvz_hf.jsView file

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/assets/main-BVqvz_hf.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidencedist/widget.js

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.109.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.109 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:33:55.122Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.