@columenlabs/lumen-ui@0.1.134
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is a React UI library with no install lifecycle scripts. Its reviewed runtime network and storage behavior is tied to explicit caller configuration or mounting, and no unrelated collection or attack behavior was found.
Decision evidence
public snapshot- The package describes itself as a shared React component library and exposes compiled entry points; its manifest shows no lifecycle scripts.
- Query-cache persistence is optional and only starts when a caller passes a persist option; it stores query state in browser localStorage.
- Assistant requests use a caller-supplied base URL and pass requests to the app's API routes.
- Telemetry is activated by mounting the exported useLumenTelemetry hook and posts to the app's endpoint by default.
- Telemetry payloads are limited to route templates, error class and stack hash, status/request ID, device category, and Web Vitals.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgThe package describes itself as a shared React component library and exposes compiled entry points; its manifest shows no lifecycle scripts.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.134.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.134 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.