registry / @mintlify/assistant-widget / 0.0.15

@mintlify/assistant-widget@0.0.15

Browser SDK and direct-mount boundary for Mintlify Assistant

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. This browser widget lazily loads its runtime and contacts its documented assistant API only after the host page invokes the widget.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Host page loads the embed script or calls a public mount/open/ask API.

Impact

User-entered prompts and an optional caller-supplied identity token are sent to the configured assistant API as documented.

Mechanism

User-invoked hosted assistant UI with session, message, feedback, and optional captcha requests.

Rationale

Direct inspection shows a browser-only Mintlify assistant widget with documented, user-triggered API traffic and no install-time execution or malicious chain. Scanner findings are explained by generated syntax-highlighting/vendor runtime data and legitimate lazy imports.

Evidence

package.jsonREADME.mddist/browser/constants.jsdist/browser/loader/loader.jsdist/browser/transport/widget-transport.jsdist/browser/runtime-6QNKUgLu.jsdist/browser/runtime-wDzz0qaB.jsdist/index.jsdist/mount/mount-assistant.jsdist/browser/transport/captcha.jsdist/browser/storage/continuation-storage.js

Network endpoints4

/api/assistant-widget

@mintlify/assistant-widget@0.0.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code