registry / @columenlabs/lumen-ui / 0.1.148
@columenlabs/lumen-ui@0.1.148
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThis version is a React UI library with no lifecycle scripts. Its telemetry is activated by a consuming app hook and sends app-level events to the app endpoint; inspected API and local-storage behavior is tied to explicit app integration features.
Static reason
No blocking static signals were detected.
Trigger
Telemetry starts when the consuming app mounts useLumenTelemetry; API calls occur through client methods invoked by the app.
Impact
No evidence of credential theft, unrelated data collection, unauthorized account actions, or harmful install-time behavior was found.
Mechanism
Telemetry batches app-level events to its configured endpoint (default /api/t), while API clients use a supplied base URL. Optional query persistence stores cached data in browser localStorage.
AI rationale
This version is a React UI library with no lifecycle scripts. Its telemetry is activated by a consuming app hook and sends app-level events to the app endpoint; inspected API and local-storage behavior is tied to explicit app integration features.
Evidence
dist/telemetry.jsdist/assistant/client.jsdist/query-client.js
Network endpoints2
/api/tcaller-configured API base
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a shared React component library and has no lifecycle scripts.
- Telemetry sends app-level screen, error, failed-request and Web Vitals events to the app's Worker; it starts when an app mounts useLumenTelemetry.
- Telemetry routes are reduced to templates, and error reports include the error class and a hash of stack frames rather than the message.
- The assistant client sends requests to routes under a caller-provided API base; its network actions are part of the exported client API.
- Query-cache persistence is optional and uses browser localStorage; sign-out clears the stored cache.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
2"name": "@columenlabs/lumen-ui",
"version": "0.1.148",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"
Low
Suspicious Lifecycle Evidence
The manifest describes a shared React component library and has no lifecycle scripts.
package.jsonView on unpkg · L2dist/telemetry.js
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.148.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.148 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.