registry / @columenlabs/lumen-ui / 0.1.108
@columenlabs/lumen-ui@0.1.108
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is a React UI library whose inspected clients use caller-provided API bases and whose telemetry starts only when the host app mounts its hook. The network and storage findings match app telemetry and optional query caching, with no concrete malicious behavior found.
Static reason
No blocking static signals were detected.
Trigger
The host app mounts useLumenTelemetry or invokes an API client; query persistence requires passing persist to createDeskQueryClient.
Impact
The inspected behavior supports app telemetry, cached reads and explicit API operations. No automatic credential exfiltration or unrelated account action was found.
Mechanism
Telemetry sends app metrics to a configurable same-origin endpoint by default; query caching uses localStorage; API clients use caller-provided base paths.
AI rationale
The package is a React UI library whose inspected clients use caller-provided API bases and whose telemetry starts only when the host app mounts its hook. The network and storage findings match app telemetry and optional query caching, with no concrete malicious behavior found.
Evidence
dist/telemetry.jsdist/query-client.jsdist/assistant/client.js
Network endpoints2
POST /api/t (default telemetry endpoint; configurable)/api/assistant (base supplied by caller)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a shared React component package and points its main entry to dist/index.js.
- The main entry exports telemetry and query-cache helpers; it does not call them at import time.
- Telemetry is described as app-owned and first-party, with route templates, error classes, stack hashes, statuses and metrics rather than messages or page text.
- Telemetry starts when the host app mounts useLumenTelemetry, which sets its app name, version and endpoint.
- Query-cache persistence is optional through the persist argument to createDeskQueryClient.
- The assistant client sends requests to a base URL supplied by its caller.
Evidence against
- The telemetry hook can send batches by beacon or fetch to /api/t by default.
- When enabled, the query cache writes successful query data to localStorage.
- The package contains API clients for assistant and people features, including credential and account-management operations initiated through their methods.
Behavioral surface
FilesystemNetwork
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.108",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dis
Low
Ai Review Evidence
The manifest describes a shared React component package and points its main entry to dist/index.js.
package.jsonView on unpkg · L1dist/index.js
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/assistant/client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.108.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.