@dori-ai/dori-side-widget@1.13.72
A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiInspectable files show a Dori chat widget with no install hooks, but they also show authenticated Shopify cart reads and writes plus customer identifier posts to Dori, and dist/widget.js.gz could not be cited as text. That leaves unresolved dual-use storefront session use and an unverified compressed sidecar, which is a warning rather than a clean or block decision.
Decision evidence
public snapshot- package.json publishes the whole dist tree, including dist/widget.js.gz, which the reader rejected as binary so that copy could not be checked against the inspectable JavaScript.
- The widget reads Shopify cart.js with credentials included, reusing the shopper storefront session.
- The widget POSTs to Shopify cart/add.js with credentials included and treats cart add, change, update, and clear as mutating routes.
- Customer email, customer id, and session identifiers are POSTed to Dori tracking URLs built from the standardapi.dori.tech base.
- package.json has no lifecycle scripts, bin entry, or dependencies; the stated entry is dist/widget.js.
- Inspectable JavaScript talks to standardapi.dori.tech as the exported widget API plus bundled PostHog hosts.
- README describes an embeddable Dori chat widget with e-commerce cart and checkout behavior.
- No child_process, eval, Function constructor, or install-time hook was found in readable source.
Source & flagged code
6 flaggedPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/assets/main-WN9R6HGm.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.72.
See all versions of @dori-ai/dori-side-widget for other recorded verdicts.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.