registry / @columenlabs/lumen-ui / 0.1.149
@columenlabs/lumen-ui@0.1.149
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package metadata and inspected entry points match a React UI library. Network activity is tied to app-provided API bases or app-mounted telemetry, and persistent query caching requires an explicit option.
Static reason
No blocking static signals were detected.
Trigger
App code calls client methods, mounts the telemetry hook, or creates a query client with persistence enabled.
Impact
Observed effects are app API requests, first-party telemetry, and local query caching; no unrelated collection or unauthorized account action was identified.
Mechanism
Browser requests use app-provided API bases; telemetry defaults to /api/t and reports app/version and normalized points; optional cache persistence uses localStorage.
AI rationale
The package metadata and inspected entry points match a React UI library. Network activity is tied to app-provided API bases or app-mounted telemetry, and persistent query caching requires an explicit option.
Network endpoints4
/api/t/api/client-error/api/assistant/api/people
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata describes a shared React component library and points to an ES module entry point.
- Assistant and people API clients use caller-supplied base paths; their account operations are exposed as methods for the app to call.
- Telemetry starts through the app-mounted useLumenTelemetry hook and sends app name, version, and queued points.
- Telemetry route reporting strips hosts and queries and replaces ID-like path segments with :id.
- Cached query state is persisted only when the caller supplies the persist option.
Evidence against
- The package contains browser network and localStorage operations, but the inspected uses support app APIs, telemetry, and query caching.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.149",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"ex
Low
Ai Review Evidence
Package metadata describes a shared React component library and points to an ES module entry point.
package.jsonView on unpkg · L1Findings
1 High1 Medium10 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/people/client.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.149.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.149 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.