registry / @columenlabs/lumen-ui / 0.1.133
@columenlabs/lumen-ui@0.1.133
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest exposes browser UI modules without install scripts. Network calls are tied to caller-configured API clients or explicitly mounted first-party telemetry, and cache persistence is opt-in.
Static reason
No blocking static signals were detected.
Trigger
Telemetry requires an app to mount useLumenTelemetry; API requests occur when the consuming application calls client methods.
Impact
Expected UI, API, telemetry, and browser-cache behavior; no evidence of package-driven host data or credential exfiltration.
Mechanism
Telemetry posts limited app, route, error fingerprint, and web-vitals data to a same-origin endpoint; query persistence writes browser cache data only when configured.
AI rationale
The manifest exposes browser UI modules without install scripts. Network calls are tied to caller-configured API clients or explicitly mounted first-party telemetry, and cache persistence is opt-in.
Evidence
browser localStorage cache when persistence is configured
Network endpoints2
/api/tcaller-provided assistant API base (documented default: /api/assistant)
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point exports browser UI modules; the manifest has no install lifecycle scripts.
- Telemetry sends batches to a same-origin endpoint, defaulting to /api/t, and only starts when an app mounts useLumenTelemetry.
- Assistant API requests use a caller-provided base URL, documented as /api/assistant.
- Query persistence is opt-in through the persist option and stores successful query data in browser localStorage.
Evidence against
- No unrelated external endpoint, credential collection, or automatic install-time behavior was identified.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
6"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
Low
Suspicious Lifecycle Evidence
The package entry point exports browser UI modules; the manifest has no install lifecycle scripts.
package.jsonView on unpkg · L6dist/telemetry.js
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.133.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.133 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.