@dori-ai/dori-side-widget@1.13.96
A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a browser-only widget entrypoint, bundled dynamic import, and Dori API calls, with no lifecycle hook or concrete malicious behavior. The compressed distribution was verified to decompress exactly to the inspected widget source.
Decision evidence
public snapshot- The manifest exposes only the browser widget entrypoint and contains no lifecycle scripts.
- The widget dynamically loads its bundled main asset after page load.
- The main asset defines Dori API routes and sends widget requests with fetch.
- The compressed widget exactly matches dist/widget.js when decompressed.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/widget.jsView on unpkgPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.96.
See all versions of @dori-ai/dori-side-widget for other recorded verdicts.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.96 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.