registry / @dori-ai/dori-side-widget / 1.13.130

@dori-ai/dori-side-widget@1.13.130

⚠ Under review

A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The inspected code shows package-aligned browser widget behavior, with a same-origin customer-token request and product-view tracking. The required dist/widget.js.gz artifact could not be inspected as UTF-8 source, so clean citation coverage remains incomplete and the unresolved package warrants manual review.

Static reason

No blocking static signals were detected.

Trigger

Loading the widget entry point in a browser.

Impact

No malicious effect was confirmed from the inspected excerpts; the unresolved compressed artifact prevents a clean determination.

Mechanism

The entry point loads the browser implementation, which performs same-origin token retrieval and product-view tracking.

AI rationale

Evidence

package.jsondist/widget.jsdist/assets/main-CnRvIzoa.jsdist/widget.js.gz

Network endpoints1

/apps/dori/customer-token

Decision evidence

public snapshot

AI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json identifies a browser widget entry point and declares no lifecycle scripts.
The entry point dynamically loads the Dori widget implementation when the page loads.
The browser code obtains a customer token from a same-origin Dori endpoint.
The browser code sends product-view details, including customer identifiers and a Dori client ID, to its configured tracking endpoint.
A required compressed artifact could not be inspected as UTF-8 source, leaving required clean-review coverage incomplete.

Evidence against

The inspected token request is same-origin and uses same-origin credentials.
The observed tracking behavior is consistent with a product widget; no unrelated credential destination or account mutation was established in the inspected excerpts.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

1main-CnRvIzoa.js").then(e=>e.h);return{initializeDoriWidget:e}},[],import.meta.url).then(({initializeDoriWidget:e})=>e()).catch(async e=>{const t=ba(e);if(t){await new Promise(e=>setTimeout(e,1500));try{const e=await imp

Low

Ai Review Evidence

The entry point dynamically loads the Dori widget implementation when the page loads.

dist/widget.jsView on unpkg · L1

dist/assets/main-CnRvIzoa.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MarkdownContent-CrWkU3On.js","../widget.js"])))=>i.map(i=>d[i]); L2: import{l as e,h as t,A as r,w as n,a,c as o,g as i,s,i as l,S as c,b as u,u as d,d as p,e as g,f as m,j as f,k as h,m as b,n as v,o as y,p as k,q as x,r as w,t as S,v as C,x as z,y...

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/assets/main-CnRvIzoa.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/widget.js

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.130.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.130 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 09:03:29.083Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @dori-ai/dori-side-widget / 1.13.130

@dori-ai/dori-side-widget@1.13.130

⚠ Under review

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Loading the widget entry point in a browser.

Impact

No malicious effect was confirmed from the inspected excerpts; the unresolved compressed artifact prevents a clean determination.

Mechanism

The entry point loads the browser implementation, which performs same-origin token retrieval and product-view tracking.

AI rationale

Evidence

package.jsondist/widget.jsdist/assets/main-CnRvIzoa.jsdist/widget.js.gz

Network endpoints1

/apps/dori/customer-token

Decision evidence

public snapshot

AI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json identifies a browser widget entry point and declares no lifecycle scripts.
The entry point dynamically loads the Dori widget implementation when the page loads.
The browser code obtains a customer token from a same-origin Dori endpoint.
The browser code sends product-view details, including customer identifiers and a Dori client ID, to its configured tracking endpoint.
A required compressed artifact could not be inspected as UTF-8 source, leaving required clean-review coverage incomplete.

Evidence against

The inspected token request is same-origin and uses same-origin credentials.
The observed tracking behavior is consistent with a product widget; no unrelated credential destination or account mutation was established in the inspected excerpts.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

Low

Ai Review Evidence

The entry point dynamically loads the Dori widget implementation when the page loads.

dist/widget.jsView on unpkg · L1

dist/assets/main-CnRvIzoa.jsView file

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/assets/main-CnRvIzoa.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/widget.js

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.130.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.130 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 09:03:29.083Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.