registry / @dori-ai/dori-side-widget / 1.13.137

@dori-ai/dori-side-widget@1.13.137

A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The entrypoint and inspected bundle implement a storefront chat widget, with customer-token retrieval tied to a same-origin route and the presence of a customer ID. The tracking and chat requests are package-aligned, and the inspected source does not substantiate the scanner’s account-hijack claim.

Static reason

No blocking static signals were detected.

Trigger

Loading the widget initializes it; its chat and tracking requests occur during widget use.

Impact

The inspected behavior does not establish unrelated credential disclosure, account-setting changes, or another attack.

Mechanism

The chat flow posts messages and optional customer context to the run-assistant route. A customer token is fetched from the same-origin route only when a customer ID is present.

AI rationale

Network endpoints3

/apps/dori/customer-token${n}/v2/run-assistant${n}/roi/track-view

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies dist/widget.js as the entrypoint and contains no lifecycle scripts.
The entrypoint imports and initializes the main widget bundle when loaded.
The widget fetches a customer token only when DORI_CUSTOMER_ID is present, using the same-origin customer-token route.
The chat flow sends the message and optional customer context to the widget’s run-assistant API route.
The tracking function sends ecommerce identifiers to the widget’s product-view tracking route; no unrelated recipient or account-setting mutation was identified.
Offline analysis reports the compressed widget expands to the inspected entrypoint and lists no analysis limitations.

Evidence against

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings

Manifest

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

1main-C4kmWUDZ.js").then(e=>e.h);return{initializeDoriWidget:e}},[],import.meta.url).then(({initializeDoriWidget:e})=>e()).catch(async e=>{const t=ba(e);if(t){await new Promise(e=>setTimeout(e,1500));try{const e=await import(wa(t));e.initializeDoriWidget?.()}catch(i){console.error("[Dori Widget] Error initializing widget (after retry):",e,

Low

Ai Review Evidence

The entrypoint imports and initializes the main widget bundle when loaded.

dist/widget.jsView on unpkg · L1

dist/assets/main-C4kmWUDZ.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MarkdownContent-VpOeIXVw.js","../widget.js"])))=>i.map(i=>d[i]); L2: import{l as e,h as t,A as n,w as r,a,c as o,g as i,s,i as l,S as c,b as d,u,d as p,e as m,f as h,j as g,k as f,m as v,n as b,o as y,p as k,q as x,r as w,t as S,v as C,x as z,y as _...

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/assets/main-C4kmWUDZ.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/widget.js

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.137.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.137 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 12:41:13.120Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @dori-ai/dori-side-widget / 1.13.137

@dori-ai/dori-side-widget@1.13.137

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Loading the widget initializes it; its chat and tracking requests occur during widget use.

Impact

The inspected behavior does not establish unrelated credential disclosure, account-setting changes, or another attack.

Mechanism

The chat flow posts messages and optional customer context to the run-assistant route. A customer token is fetched from the same-origin route only when a customer ID is present.

AI rationale

Network endpoints3

/apps/dori/customer-token${n}/v2/run-assistant${n}/roi/track-view

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies dist/widget.js as the entrypoint and contains no lifecycle scripts.
The entrypoint imports and initializes the main widget bundle when loaded.
The widget fetches a customer token only when DORI_CUSTOMER_ID is present, using the same-origin customer-token route.
The chat flow sends the message and optional customer context to the widget’s run-assistant API route.
The tracking function sends ecommerce identifiers to the widget’s product-view tracking route; no unrelated recipient or account-setting mutation was identified.
Offline analysis reports the compressed widget expands to the inspected entrypoint and lists no analysis limitations.

Evidence against

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings

Manifest

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

Low

Ai Review Evidence

The entrypoint imports and initializes the main widget bundle when loaded.

dist/widget.jsView on unpkg · L1

dist/assets/main-C4kmWUDZ.jsView file

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/assets/main-C4kmWUDZ.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/widget.js

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.137.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.137 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 12:41:13.120Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.