@columenlabs/lumen-ui@0.1.139
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package exposes React UI components with no install hook or executable entry point. Its network calls are tied to configured application features, telemetry begins through an explicitly mounted hook and carries bounded event data, and query persistence requires an explicit option.
Decision evidence
public snapshot- The package is described as shared React components and exports compiled UI entry points.
- Assistant requests use a caller-supplied API base; chat submission sends a POST when the component invokes its send action.
- Telemetry is described as first-party and sends route templates, error classes and stack hashes, statuses, and numeric values to the app’s worker.
- Telemetry starts when the app mounts the telemetry hook; query-cache persistence is enabled only when the caller supplies a persist option.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgThe package is described as shared React components and exports compiled UI entry points.
package.jsonView on unpkg · L6Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.139.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.139 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.