registry / @columenlabs/lumen-ui / 0.1.145
@columenlabs/lumen-ui@0.1.145
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install hooks, and its inspected network activity serves configurable UI features or documented first-party telemetry. Storage is browser-local and query persistence is opt-in; no malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
App code mounts the telemetry hook, configures a suite source or assistant client, or opts into query persistence; UI requests otherwise follow user interaction.
Impact
No unauthorized credential collection, unrelated external transmission, or harmful automatic action was found.
Mechanism
Telemetry sends documented screen, error, failed-request and Web Vitals data to the app’s endpoint. The suite switcher fetches a configured app list, assistant calls use a configured base path, and optional query persistence uses localStorage.
AI rationale
The package has no install hooks, and its inspected network activity serves configurable UI features or documented first-party telemetry. Storage is browser-local and query persistence is opt-in; no malicious behavior was found.
Network endpoints3
same-origin /api/t (default telemetry endpoint)caller-configured suite source URLcaller-configured assistant API base path (default documented as /api/assistant)
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as a React component library and has no lifecycle scripts; its main entry is dist/index.js.
- The suite switcher fetches a caller-supplied source only when that source is set, to populate the app menu.
- Telemetry is documented as first-party, limits reported data, and starts when an app mounts the exported hook.
- Assistant API requests use a caller-supplied base path and correspond to user-facing assistant features.
- Persisted query data is opt-in through the persist option and is cleared on sign-out.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.145",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
Low
Suspicious Lifecycle Evidence
The manifest identifies this as a React component library and has no lifecycle scripts; its main entry is dist/index.js.
package.jsonView on unpkg · L1Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/app-switcher.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.145.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.145 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.