registry / @columenlabs/lumen-ui / 0.1.141
@columenlabs/lumen-ui@0.1.141
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package exposes UI components and app adapters, with no install lifecycle scripts. The flagged browser storage and network behavior is query caching and app-level telemetry initiated through an explicit React hook.
Static reason
No blocking static signals were detected.
Trigger
Query persistence runs when an application creates a query client with persistence enabled; telemetry starts when an application mounts useLumenTelemetry.
Impact
Persisted query data remains in the browser; app telemetry reports limited event and performance data to the configured endpoint.
Mechanism
Query results are stored in browser localStorage. Telemetry sends batched app events to /api/t by default.
AI rationale
The package exposes UI components and app adapters, with no install lifecycle scripts. The flagged browser storage and network behavior is query caching and app-level telemetry initiated through an explicit React hook.
Network endpoints1
/api/t
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports React UI entry points; its manifest shows no lifecycle scripts.
- Query persistence is browser-only and stores successful query results, with an opt-out per query.
- Telemetry is sent to the app's worker at /api/t by default, after the app mounts the telemetry hook.
- Telemetry batches app and version identifiers with UI views, failed request summaries, error fingerprints, and Web Vitals.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
7"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./ui/
Low
Suspicious Lifecycle Evidence
The package exports React UI entry points; its manifest shows no lifecycle scripts.
package.jsonView on unpkg · L7dist/query-client.js
Findings
1 High1 Medium7 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.141.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.141 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.