registry / @columenlabs/lumen-ui / 0.1.105
@columenlabs/lumen-ui@0.1.105
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is a React UI library with no install hooks in its metadata. The flagged network and filesystem references support configured application APIs, opt-in-by-integration telemetry, and a browser query cache; no concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Normal use of the exported UI features; telemetry runs only when an application mounts useLumenTelemetry.
Impact
No malicious or unauthorized data collection or action was identified.
Mechanism
Feature API calls use configured URLs or same-site routes. Optional telemetry batches filtered event data to its configured endpoint.
AI rationale
The package is a React UI library with no install hooks in its metadata. The flagged network and filesystem references support configured application APIs, opt-in-by-integration telemetry, and a browser query cache; no concrete malicious behavior was found.
Network endpoints3
/api/t/api/client-error/api/assistant
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies this as a React component library and points its main and assistant exports to dist JavaScript modules.
- Telemetry begins only when an application mounts useLumenTelemetry; its endpoint defaults to the same-site /api/t route.
- Telemetry points contain app/version and filtered route, event, status, request, device, or web-vital fields; errors are represented by class and stack hash.
- API requests use the URL supplied to the adapter and pass it to fetch; the assistant adapter documents a caller-mounted /api/assistant base.
- Query persistence is an optional browser localStorage cache with expiry and a 2 MB write limit.
Evidence against
- The package metadata has no install or lifecycle scripts.
- The reviewed network activity is tied to UI features or an explicitly mounted telemetry hook; no unrelated hard-coded collector or credential forwarding was identified.
Behavioral surface
FilesystemNetworkWebSocket
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.105",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dis
Low
Ai Review Evidence
package.json identifies this as a React component library and points its main and assistant exports to dist JavaScript modules.
package.jsonView on unpkg · L1Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/api-fetch.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.105.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.105 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.