registry / @dori-ai/dori-side-widget / 1.13.73

@dori-ai/dori-side-widget@1.13.73

A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Inspectable sources are a browser-only Dori storefront chat widget with no npm lifecycle, talking to standardapi.dori.tech, PostHog, and host cart APIs. dist/widget.js.gz is binary and could not be cited, so the package cannot be marked clean even though no concrete malicious chain was found.

Static reason

No blocking static signals were detected.

Trigger

A site embeds dist/widget.js in the browser; npm install does not run package code.

Impact

No confirmed supply-chain attack; leftover uncertainty is the unread compressed artifact and dual-use cart/session calls.

Mechanism

Storefront chat widget plus an unread gzip sidecar

AI rationale

Network endpoints3

standardapi.dori.techapp.posthog.comus.i.posthog.com

Decision evidence

public snapshot

AI called this Suspicious at 58.0% confidence as Unknown with high false-positive risk.

Evidence for warning

package.json ships dist/**/* with no lifecycle scripts, including unread compressed dist/widget.js.gz beside dist/widget.js.
The widget reads the host Shopify cart with credentials include and posts customer_email and customer_id to Dori tracking URLs.
Runtime traffic goes to https://standardapi.dori.tech and PostHog hosts when a site embeds the widget.

Evidence against

package.json has no preinstall, install, postinstall, bin, or dependency fields; entry is dist/widget.js.
No child_process, eval, or Function constructor; dynamic import is Vite markdown-chunk loading.
WhatsApp, Telegram, example.com, and fb.me strings are channel openers, a URL fallback, and React PropTypes docs.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings

Manifest

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

dist/assets/main-i9p_sogZ.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MarkdownContent-Dgl1Vpq2.js","../widget.js"])))=>i.map(i=>d[i]); L2: import{l as e,h as t,A as r,w as n,a,c as o,g as i,s,i as l,S as c,b as u,u as d,d as p,e as f,f as g,j as m,k as h,m as b,n as v,o as y,p as k,q as x,r as w,t as S,v as C,x as z,y...

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/assets/main-i9p_sogZ.jsView on unpkg · L1

Findings

2 High6 Medium4 Low

HighBrowser Session Account Hijackdist/assets/main-i9p_sogZ.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/assets/main-i9p_sogZ.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.73.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.73 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 08:52:30.058Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @dori-ai/dori-side-widget / 1.13.73

@dori-ai/dori-side-widget@1.13.73

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A site embeds dist/widget.js in the browser; npm install does not run package code.

Impact

No confirmed supply-chain attack; leftover uncertainty is the unread compressed artifact and dual-use cart/session calls.

Mechanism

Storefront chat widget plus an unread gzip sidecar

AI rationale

Network endpoints3

standardapi.dori.techapp.posthog.comus.i.posthog.com

Decision evidence

public snapshot

AI called this Suspicious at 58.0% confidence as Unknown with high false-positive risk.

Evidence for warning

package.json ships dist/**/* with no lifecycle scripts, including unread compressed dist/widget.js.gz beside dist/widget.js.
The widget reads the host Shopify cart with credentials include and posts customer_email and customer_id to Dori tracking URLs.
Runtime traffic goes to https://standardapi.dori.tech and PostHog hosts when a site embeds the widget.

Evidence against

package.json has no preinstall, install, postinstall, bin, or dependency fields; entry is dist/widget.js.
No child_process, eval, or Function constructor; dynamic import is Vite markdown-chunk loading.
WhatsApp, Telegram, example.com, and fb.me strings are channel openers, a URL fallback, and React PropTypes docs.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings

Manifest

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

dist/assets/main-i9p_sogZ.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/assets/main-i9p_sogZ.jsView on unpkg · L1

Findings

2 High6 Medium4 Low

HighBrowser Session Account Hijackdist/assets/main-i9p_sogZ.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/assets/main-i9p_sogZ.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.73.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.73 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 08:52:30.058Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.