registry / @dori-ai/dori-side-widget / 1.13.162

@dori-ai/dori-side-widget@1.13.162

A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The manifest has no lifecycle hooks, and the inspected runtime excerpts show widget UI, same-origin token retrieval, and an assistant request. The scanner's account-hijack label is not borne out by those excerpts, and the compressed artifact is identified as UTF-8 JavaScript.

Static reason

No blocking static signals were detected.

Trigger

A storefront loads and uses the widget.

Impact

The inspected behavior supports the widget's storefront assistant function; no unrelated account mutation or other attack was established.

Mechanism

The widget obtains a token from a same-origin endpoint and submits an assistant request with a token already present on the window.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies dist/widget.js as the entry point and contains no lifecycle scripts.
The entry bundle references the widget's apply, reporting, and main assets.
The main asset retrieves a customer token through a same-origin storefront endpoint.
The assistant request uses the widget's run-assistant endpoint and a window-provided token.
The apply asset defines a Dori ask button, consistent with the package's widget role.
The compressed artifact analysis identifies UTF-8 JavaScript and says execution and network access were disabled.

Evidence against

The browser account-hijack scanner label is not supported by the inspected excerpts: they show storefront token retrieval and an assistant request, not an account-settings mutation.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Source & flagged code

6 flagged

dist/widget.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./assets/apply-n5QgObMa.js","./assets/report-BHr6U1PB.js","./assets/main-1jBAkc3j.js"])))=>i.map(i=>d[i]); L2: const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

dist/assets/main-1jBAkc3j.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MarkdownContent-DQrC5GlD.js","../widget.js","./report-BHr6U1PB.js"])))=>i.map(i=>d[i]); L2: import{l as e,h as t,A as r,w as n,a,c as o,g as i,s,S as l,b as c,i as d,u,d as p,e as m,f as h,j as f,k as g,m as v,n as b,o as y,p as k,q as x,r as w,t as S,v as C,x as z,y as j...

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/assets/main-1jBAkc3j.jsView on unpkg · L1

Findings

3 High4 Medium5 Low

HighBrowser Session Account Hijackdist/assets/main-1jBAkc3j.js

HighShips High Entropy Blobdist/widget.js.gz

HighSemantic Analysis Limiteddist/assets/apply-n5QgObMa.js#virtual:normalized:round1

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.162.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.162 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-28 10:18:23.240Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @dori-ai/dori-side-widget / 1.13.162

@dori-ai/dori-side-widget@1.13.162

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A storefront loads and uses the widget.

Impact

The inspected behavior supports the widget's storefront assistant function; no unrelated account mutation or other attack was established.

Mechanism

The widget obtains a token from a same-origin endpoint and submits an assistant request with a token already present on the window.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies dist/widget.js as the entry point and contains no lifecycle scripts.
The entry bundle references the widget's apply, reporting, and main assets.
The main asset retrieves a customer token through a same-origin storefront endpoint.
The assistant request uses the widget's run-assistant endpoint and a window-provided token.
The apply asset defines a Dori ask button, consistent with the package's widget role.
The compressed artifact analysis identifies UTF-8 JavaScript and says execution and network access were disabled.

Evidence against

The browser account-hijack scanner label is not supported by the inspected excerpts: they show storefront token retrieval and an assistant request, not an account-settings mutation.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Source & flagged code

6 flagged

dist/widget.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

dist/assets/main-1jBAkc3j.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/assets/main-1jBAkc3j.jsView on unpkg · L1

Findings

3 High4 Medium5 Low

HighBrowser Session Account Hijackdist/assets/main-1jBAkc3j.js

HighShips High Entropy Blobdist/widget.js.gz

HighSemantic Analysis Limiteddist/assets/apply-n5QgObMa.js#virtual:normalized:round1

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.162.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.162 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-28 10:18:23.240Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.