@columenlabs/lumen-ui@0.1.112
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected entry points and flagged runtime code are consistent with a React UI library. Telemetry is described as first-party, limited in content, and activated through an explicitly mounted hook; no unrelated collector or automatic credential flow was found.
Decision evidence
public snapshot- Package metadata describes a shared React component library and points to its ESM entry point.
- Telemetry is documented as first-party app telemetry that omits error messages, URL queries, page text, and typed content.
- Telemetry sends batched points to a configurable endpoint, defaulting to the app-relative `/api/t`, after the app mounts `useLumenTelemetry`.
- The assistant client uses a supplied base path, documented as `/api/assistant`, for its API requests.
- The package includes browser telemetry for screen views, errors, failed requests, and Web Vitals.
- The query client can persist successful query data in browser local storage when persistence is enabled.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgPackage metadata describes a shared React component library and points to its ESM entry point.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.112.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.112 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.