@dori-ai/dori-side-widget@1.13.121
A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected behavior is consistent with the shopping widget: the alleged account mutation is cart tracking, and authentication targets the Dori service. The compressed artifact exactly matches the JavaScript entrypoint, and no concrete malicious behavior was established.
Decision evidence
public snapshot- package.json declares a browser widget entrypoint and contains no lifecycle scripts or self-dependencies.
- The flagged browser mutation updates a cart visitor attribute for Dori session tracking; inspected code does not establish account hijacking.
- dist/widget.js.gz decompresses to exactly the bytes of dist/widget.js.
- The widget uses the fixed https://standardapi.dori.tech API endpoint.
- Customer authentication requests a Dori token through a same-origin Dori application route.
Source & flagged code
6 flaggedPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/assets/main-dEolGMVQ.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.121.
See all versions of @dori-ai/dori-side-widget for other recorded verdicts.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.121 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.