@columenlabs/lumen-ui@0.1.124
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThis version is a React UI library with no lifecycle scripts, and its reviewed import paths expose components and helpers without starting data collection. Query persistence requires an explicit option, while telemetry is bounded, first-party, and starts only when an app mounts its hook.
Decision evidence
public snapshot- The manifest describes a React component library and declares no lifecycle scripts.
- The package entry point exports UI components and helper functions; it does not itself invoke the query persistence setup.
- Query persistence is enabled only when a caller supplies the `persist` option to `createDeskQueryClient`.
- The telemetry helper documents first-party, same-origin app telemetry and limits reported data to route templates, error classes, stack hashes, statuses, and numeric values.
- Telemetry points are ignored until `useLumenTelemetry` has named the app.
- The package contains browser network and filesystem-like storage APIs for ordinary app features, including API requests and optional query-cache persistence.
- The optional telemetry helper sends batches to `/api/t` by default when an app mounts it.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgThe manifest describes a React component library and declares no lifecycle scripts.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.124.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.124 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.