@columenlabs/lumen-ui@0.1.153
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest exposes a React UI package without install hooks or a bin. Network activity is tied to app APIs and documented first-party telemetry that sends limited event data after the app opts into mounting its telemetry hook; no attack behavior was identified.
Decision evidence
public snapshot- The package exports React UI modules and has no install lifecycle scripts or executable bin.
- Telemetry is sent in batches to the app’s Worker, with `/api/t` as the default endpoint.
- Telemetry points use route templates, error classes and stack hashes, statuses, and numeric values; the source says it excludes error messages, query strings, page text, and typed input.
- Telemetry starts when the app mounts `useLumenTelemetry`; the assistant client uses a caller-provided API base, documented as `/api/assistant`.
- Query cache persistence is limited to successful queries and excludes queries marked `persist: false`.
- Client error reports go to the app’s same-origin `/api/client-error` endpoint.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgThe package exports React UI modules and has no install lifecycle scripts or executable bin.
package.jsonView on unpkg · L6Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.153.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.153 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.