registry / @columenlabs/lumen-ui / 0.1.115
@columenlabs/lumen-ui@0.1.115
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe reviewed network behavior is limited to app-relative APIs and telemetry that is activated when the host app mounts its hook. Storage use is browser-side query caching; no malicious collection, unauthorized account action, or install-time behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Telemetry starts when the host app mounts useLumenTelemetry. API requests are made through caller-configured clients.
Impact
No unauthorized credential collection, foreign-host exfiltration, account actions, or destructive behavior was identified.
Mechanism
Telemetry sends limited app metrics to a relative app endpoint. Query cache data is stored in browser localStorage.
AI rationale
The reviewed network behavior is limited to app-relative APIs and telemetry that is activated when the host app mounts its hook. Storage use is browser-side query caching; no malicious collection, unauthorized account action, or install-time behavior was identified.
Network endpoints2
POST /api/t (default telemetry endpoint)Caller-supplied assistant API base (documented default: /api/assistant)
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a React UI entry point and named UI and telemetry exports.
- Telemetry is described as first-party, sent to the app's Worker at the default POST /api/t endpoint, and limited to route templates, error classes, stack hashes, statuses and numeric values.
- Telemetry starts from the useLumenTelemetry React hook when the host app mounts it; the endpoint can be supplied by the caller.
- Telemetry queues data only after it has been started, and filters route and identifier fields.
- The query client persists cache data to browser localStorage; this is browser-side caching, not a filesystem write.
- The assistant client sends requests to a base route supplied by the caller.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgdist/index.jsView file
65export { LumenPager } from './pager.js';
export { clearPersistedQueries, createDeskQueryClient } from './query-client.js';
export { apiRoute, reportClient, reportClientError, reportFailedFetch, stackFingerprint, useLumenTe
Low
Ai Review Evidence
The package exposes a React UI entry point and named UI and telemetry exports.
dist/index.jsView on unpkg · L65dist/telemetry.js
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/assistant/client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.115.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.115 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.