@dori-ai/dori-side-widget@1.13.99
A modern, responsive chat widget built with React and Chakra UI, designed for seamless integration into any website. The widget provides an AI-powered chat experience with e-commerce capabilities, perfect for customer support and sales assistance.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a browser-only widget entry with no package lifecycle hooks. Its cookie and network use is aligned with widget telemetry and Dori service requests, with no concrete malicious behavior identified.
Decision evidence
public snapshot- The manifest selects a browser bundle as its main entry and defines no lifecycle scripts.
- The entry dynamically loads the widget module only in a browser page context.
- The loaded module creates and renders a widget host element in the document.
- The package reads its own dori_client_id cookie for product-view telemetry; no credential harvesting or unrelated recipient was identified.
- The compressed widget artifact is present but is not selected as the manifest entry.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/widget.jsView on unpkgPackage source references dynamic require/import behavior.
dist/widget.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @dori-ai/dori-side-widget@1.13.99.
See all versions of @dori-ai/dori-side-widget for other recorded verdicts.
- Review the evidence and your use of @dori-ai/dori-side-widget@1.13.99 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.