registry / @columenlabs/lumen-ui / 0.1.131
@columenlabs/lumen-ui@0.1.131
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest describes a shared React UI package with no install scripts. The flagged network and storage behavior is limited to application-mounted telemetry and optional browser query caching, with no concrete malicious behavior identified.
Static reason
No blocking static signals were detected.
Trigger
Telemetry starts when an application mounts useLumenTelemetry; query-cache persistence is enabled only when the app supplies persist.
Impact
No evidence of credential collection, unrelated data transmission, install-time activity, or harmful account actions was found.
Mechanism
Telemetry batches app/version and limited route, error, request, and Web Vital metadata to /api/t by default. Optional query persistence uses browser localStorage.
AI rationale
The manifest describes a shared React UI package with no install scripts. The flagged network and storage behavior is limited to application-mounted telemetry and optional browser query caching, with no concrete malicious behavior identified.
Network endpoints1
/api/t
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as a shared React component package and exposes built component entry points.
- No install lifecycle scripts are declared in the inspected manifest.
- Telemetry queues only after the app calls the useLumenTelemetry hook; it sends app/version and bounded route, error-class, stack-hash, status, request-ID, and Web Vital data to a configurable endpoint defaulting to /api/t.
- Telemetry comments state that error messages, URL queries, page text, and typed content are excluded.
- Query-cache persistence is optional and uses browser localStorage for successful queries, with support for excluding queries.
Evidence against
- The package includes browser telemetry that can send route and error metadata to /api/t when an application mounts the telemetry hook.
- When configured, the query client persists successful query data in browser localStorage.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
6 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.131",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "modul
Low
Ai Review Evidence
The manifest identifies this as a shared React component package and exposes built component entry points.
package.jsonView on unpkg · L1dist/telemetry.js
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.131.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.131 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.