registry / @columenlabs/lumen-ui / 0.1.130
@columenlabs/lumen-ui@0.1.130
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe reviewed network behavior supports the package's UI, service-client, and opt-in telemetry features. No install-time action, import-time data collection, credential exfiltration, or unrelated external endpoint was identified.
Static reason
No blocking static signals were detected.
Trigger
Telemetry requires an app to mount useLumenTelemetry; service-client requests occur when callers invoke their methods.
Impact
No malicious impact identified.
Mechanism
The inspected code sends first-party telemetry to /api/t and uses caller-provided service bases for API requests. The new fetch helper only adds a timeout.
AI rationale
The reviewed network behavior supports the package's UI, service-client, and opt-in telemetry features. No install-time action, import-time data collection, credential exfiltration, or unrelated external endpoint was identified.
Network endpoints3
POST /api/t (configurable)caller-provided assistant base (documented default /api/assistant)caller-provided people base (documented default /api/people)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata identifies a React component library and points to JavaScript module entry points; no lifecycle scripts or executable binary are declared.
- Telemetry is documented as first-party browser telemetry sent by default to the app's /api/t endpoint; it records route templates, error classes and stack hashes, statuses, and numeric values.
- Telemetry starts through the explicitly mounted useLumenTelemetry hook, rather than on package import.
- Assistant and people clients send requests to caller-provided service bases, with documented same-origin API paths.
- The fetchWithin helper wraps a supplied fetch request with a timeout.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.130",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./ui/*": {
"types": "./dist/ui/*.d.ts",
"default": "./dist/ui/*.js"
},
"./people": {
"types": "./dist/people/index.d.ts",
"default": "./dist/people/index.js"
},
"./as
Low
Suspicious Lifecycle Evidence
Package metadata identifies a React component library and points to JavaScript module entry points; no lifecycle scripts or executable binary are declared.
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/fetch-within.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.130.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.130 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.