registry / @columenlabs/lumen-ui / 0.1.120
@columenlabs/lumen-ui@0.1.120
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest presents a React component library without lifecycle scripts, and the reviewed network and storage code serves its UI and app integration features. Telemetry requires the integrating app to mount its hook and sends bounded data to an app-relative endpoint.
Static reason
No blocking static signals were detected.
Trigger
Telemetry starts when an integrating app mounts useLumenTelemetry; API requests occur when app components or clients call them; cache storage is opt-in through persist.
Impact
No source evidence of credential theft, unrelated data collection, or harmful automatic actions.
Mechanism
Telemetry posts bounded client metrics to the app-relative /api/t endpoint. API clients use app-provided bases, and optional query persistence stores cache data in browser local storage.
AI rationale
The manifest presents a React component library without lifecycle scripts, and the reviewed network and storage code serves its UI and app integration features. Telemetry requires the integrating app to mount its hook and sends bounded data to an app-relative endpoint.
Network endpoints2
/api/tcaller-supplied API base
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a React UI package and exposes its main entry through dist/index.js.
- Telemetry starts only when an app mounts useLumenTelemetry; its default endpoint is the app-relative /api/t route.
- Telemetry points are limited to route templates, error class and stack hash, status, and numeric values; the source says it excludes error messages, URL queries, page text, and typed input.
- Assistant requests use a base URL supplied by the integrating application.
- Query-cache persistence is optional and only enabled when createDeskQueryClient receives a persist option.
Evidence against
- The package includes browser network and local-storage operations, including telemetry and optional query-cache persistence.
- Telemetry can report uncaught errors and Web Vitals after the app mounts its telemetry hook.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.120",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./ui/*": {
"types": "./dist/ui/*.d.ts",
"default": "./dist/ui/*.js"
},
"./people": {
"types": "./dist/people/index.d.ts",
"default": "./dist/people/index.js"
},
"./assistant":
Low
Ai Review Evidence
The manifest describes a React UI package and exposes its main entry through dist/index.js.
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.120.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.120 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.