@dori-ai/dori-side-widget@1.13.159
A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe flagged account-related behavior is a user-triggered store notification signup using an entered email and the storefront’s detected Klaviyo account. The inspected source did not establish credential harvesting, unrelated account mutation, or another attack surface.
Decision evidence
public snapshot- package.json identifies dist/widget.js as the package entrypoint and publishes the dist files.
- The follow-up handler validates an email entered in the form and runs only when a follow-up signup is present.
- The Klaviyo request targets the detected storefront account for a back-in-stock signup.
- The send control invokes the handler on click; the apply bundle creates a button whose click listener is supplied by its caller.
- The offline artifact record identifies the inspected gzip file and its expanded source hash.
Source & flagged code
6 flaggedPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/assets/main-DG1S0akH.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.159.
See all versions of @dori-ai/dori-side-widget for other recorded verdicts.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.159 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.