registry / @columenlabs/lumen-ui / 0.1.142
@columenlabs/lumen-ui@0.1.142
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle scripts, and the entry points export UI modules. Reviewed network and storage behavior is tied to app features; telemetry is first-party, documented, and starts only when the app mounts its hook.
Static reason
No blocking static signals were detected.
Trigger
App integration and use of the exported components; telemetry runs only when the app mounts its telemetry hook.
Impact
No malicious impact identified in the inspected source.
Mechanism
App-relative API calls, opt-in first-party telemetry, and browser-local query caching with sign-out cleanup.
AI rationale
The manifest has no install lifecycle scripts, and the entry points export UI modules. Reviewed network and storage behavior is tied to app features; telemetry is first-party, documented, and starts only when the app mounts its hook.
Evidence
browser localStorage entries prefixed lumen-cache:
Network endpoints3
/api/t/api/client-errorcaller-configured assistant and people API paths
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports UI modules through its declared entry points; the manifest shows no lifecycle scripts.
- The query client stores successful app queries in browser localStorage and clears persisted queries on sign-out.
- Telemetry is sent to the app’s Worker by default at /api/t; its documented points contain route templates and limited error or performance details.
- Telemetry starts when an app mounts useLumenTelemetry, and assistant chat is sent through the composer’s onSend handler.
- People operations such as inviting, updating, and revoking are exposed as client methods for the app to call.
Evidence against
- The package includes runtime telemetry, but the hook is opt-in and the source documents the collected fields and first-party destination.
- The assistant and people clients make network requests, but use configured app API roots rather than hard-coded foreign hosts.
Behavioral surface
FilesystemNetworkWebSocket
Source & flagged code
8 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
7"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./ui/
Low
Suspicious Lifecycle Evidence
The package exports UI modules through its declared entry points; the manifest shows no lifecycle scripts.
package.jsonView on unpkg · L7dist/query-client.js
Findings
1 High1 Medium10 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/lumen-assistant.js
LowAi Review Evidencedist/people/client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.142.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.142 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.