registry / @columenlabs/lumen-ui / 0.1.147
@columenlabs/lumen-ui@0.1.147
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package presents as a React UI library, and the inspected network and storage operations serve its app-facing features. Telemetry is limited to first-party event data and is activated by the host app mounting the telemetry hook.
Static reason
No blocking static signals were detected.
Trigger
Telemetry runs when the host app mounts the telemetry hook; API calls run when the host app invokes client methods.
Impact
No unrequested collection, credential transfer, destructive action, or unrelated external execution was found in the reviewed flows.
Mechanism
Telemetry posts limited event points to a relative app endpoint, API adapters use supplied base paths, and optional query persistence uses browser localStorage.
AI rationale
The package presents as a React UI library, and the inspected network and storage operations serve its app-facing features. Telemetry is limited to first-party event data and is activated by the host app mounting the telemetry hook.
Network endpoints3
/api/t/api/client-errorcaller-supplied assistant and people API base paths
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the package and its exports to dist JavaScript modules for a React component library.
- Telemetry is described as first-party data sent to the app's /api/t route; its documented points contain route templates, error classes and stack hashes, statuses, and numeric values.
- Telemetry collection starts only when an app mounts useLumenTelemetry with an app name and endpoint options.
- The assistant client sends requests to a caller-supplied base path, while query persistence uses browser localStorage and is cleared on sign-out.
Evidence against
- The package includes runtime network and browser-storage code, but the inspected flows use app-configured API routes or local browser storage.
- The assistant client exposes methods for user-requested settings, key management, sign-in, and chat operations; no automatic external account action was identified.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
8 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
7"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./ui/
Low
Ai Review Evidence
The manifest points the package and its exports to dist JavaScript modules for a React component library.
package.jsonView on unpkg · L7dist/telemetry.js
Findings
1 High1 Medium10 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.147.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.147 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.