registry / Staged payload carrier / @dori-ai/dori-side-widget / 1.13.92

@dori-ai/dori-side-widget@1.13.92

A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The inspected JavaScript is consistent with a Dori customer chat widget and shows user-form contact submission, not a concrete malware chain. The opaque compressed artifact prevents the required complete clean verification.

Static reason

No blocking static signals were detected.

Trigger

A visitor submits the widget contact form.

Impact

Visitor contact data is transmitted to the widget service; the compressed artifact prevents a fully clean source-grounded decision.

Mechanism

Browser POST of form-supplied contact details to the Dori API.

AI rationale

Evidence

dist/widget.jsdist/assets/main-DTQkJWoD.jsdist/widget.js.gz

Network endpoints1

standardapi.dori.tech

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest exposes a browser JavaScript entry point and contains no lifecycle script field.
The entry bundle dynamically imports a bundled widget asset at runtime.
The widget posts user-entered phone and email contact details to a Dori API endpoint.
dist/widget.js.gz is a compressed binary artifact that cannot be safely cited as UTF-8 in this review.

Evidence against

No preinstall, install, postinstall, or other manifest lifecycle hook is present.
The contact request is made from a visible phone/email form flow rather than from filesystem or environment harvesting.
The observed API host is aligned with the Dori package branding.
No child-process execution, local file access, credential harvesting, or destructive behavior was confirmed in inspected source.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

1const va="https://standardapi.dori.tech",fa=["pointerdown","keydown"],ma=["pointermove","touchstart","wheel","scroll"],ya=["pointerover","focusin","click"];function ba(e)

Medium

Ai Review Evidence

The entry bundle dynamically imports a bundled widget asset at runtime.

dist/widget.jsView on unpkg · L1

dist/assets/main-DTQkJWoD.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./MarkdownContent-DfvJN9d1.js","../widget.js"])))=>i.map(i=>d[i]); L2: import{l as e,h as t,A as r,w as n,a,c as o,g as i,s,i as l,S as c,b as u,u as d,d as p,e as f,f as g,j as m,k as h,m as b,n as v,o as y,p as k,q as x,r as w,t as S,v as C,x as z,y...

Findings

2 High6 Medium4 Low

HighBrowser Session Account Hijackdist/assets/main-DTQkJWoD.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/widget.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.92.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.92 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 15:41:46.709Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Staged payload carrier / @dori-ai/dori-side-widget / 1.13.92

@dori-ai/dori-side-widget@1.13.92

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A visitor submits the widget contact form.

Impact

Visitor contact data is transmitted to the widget service; the compressed artifact prevents a fully clean source-grounded decision.

Mechanism

Browser POST of form-supplied contact details to the Dori API.

AI rationale

Evidence

dist/widget.jsdist/assets/main-DTQkJWoD.jsdist/widget.js.gz

Network endpoints1

standardapi.dori.tech

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest exposes a browser JavaScript entry point and contains no lifecycle script field.
The entry bundle dynamically imports a bundled widget asset at runtime.
The widget posts user-entered phone and email contact details to a Dori API endpoint.
dist/widget.js.gz is a compressed binary artifact that cannot be safely cited as UTF-8 in this review.

Evidence against

No preinstall, install, postinstall, or other manifest lifecycle hook is present.
The contact request is made from a visible phone/email form flow rather than from filesystem or environment harvesting.
The observed API host is aligned with the Dori package branding.
No child-process execution, local file access, credential harvesting, or destructive behavior was confirmed in inspected source.

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

6 flagged

dist/widget.jsView file

1const e={},t=function(t,i,r){let s=Promise.resolve();if(i&&i.length>0){let t=function(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:"fulfilled",value:e}),e=>({...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/widget.jsView on unpkg · L1

1const va="https://standardapi.dori.tech",fa=["pointerdown","keydown"],ma=["pointermove","touchstart","wheel","scroll"],ya=["pointerover","focusin","click"];function ba(e)

Medium

Ai Review Evidence

The entry bundle dynamically imports a bundled widget asset at runtime.

dist/widget.jsView on unpkg · L1

dist/assets/main-DTQkJWoD.jsView file

Findings

2 High6 Medium4 Low

HighBrowser Session Account Hijackdist/assets/main-DTQkJWoD.js

HighShips High Entropy Blobdist/widget.js.gz

MediumDynamic Requiredist/widget.js

MediumNetwork

MediumShips Compressed Blobdist/widget.js.gz

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/widget.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @dori-ai/dori-side-widget@1.13.92.

See all versions of @dori-ai/dori-side-widget for other recorded verdicts.

Review the evidence and your use of @dori-ai/dori-side-widget@1.13.92 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 15:41:46.709Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.