@dori-ai/dori-side-widget@1.13.127
⚠ Under reviewA modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe inspected code supports ordinary widget operation and did not establish the scanner's claimed account hijacking behavior. The required compressed artifact could not be cited because it yielded no complete printable UTF-8 excerpt, so clean citation coverage remains incomplete.
Decision evidence
public snapshot- The manifest identifies a browser widget entrypoint and includes only distribution files and a README.
- The widget requests a customer token from its own relative Dori application path using same-origin credentials.
- Product-view tracking sends customer and product identifiers to a configured tracking endpoint; the inspected code does not show account-setting mutation or an unrelated recipient.
- The required compressed artifact could not be inspected or cited as a printable UTF-8 source excerpt.
Source & flagged code
6 flaggedPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/assets/main-EgLEdB3l.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.127.
See all versions of @dori-ai/dori-side-widget for other recorded verdicts.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.127 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.