registry / @columenlabs/lumen-ui / 0.1.156
@columenlabs/lumen-ui@0.1.156
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package exposes React UI components and caller-configured API clients. Its telemetry is mounted by the consuming app and documents bounded app metrics; the reviewed code does not show unrelated collection or unauthorized account actions.
Static reason
No blocking static signals were detected.
Trigger
Application use: telemetry starts when the app mounts its telemetry hook; API calls occur through client methods, and persistent query caching is enabled when configured.
Impact
Expected app telemetry and data fetching/caching; no evidence of credential theft, unsolicited account actions, or unrelated external collection.
Mechanism
Reports bounded route, error, request-status, and Web Vitals data to a configurable app endpoint; API adapters use caller-provided base URLs; query data may be cached in browser local storage.
AI rationale
The package exposes React UI components and caller-configured API clients. Its telemetry is mounted by the consuming app and documents bounded app metrics; the reviewed code does not show unrelated collection or unauthorized account actions.
Evidence
Browser localStorage for configured query-cache persistence
Network endpoints2
/api/t (default telemetry endpoint)Caller-provided assistant and people API base URLs
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a React component library and points to `dist/index.js` as its main entry.
- Telemetry is documented as first-party browser reporting to the app’s Worker; its fields are limited to route templates, error class and stack hash, status, and numeric metrics.
- Telemetry starts when an app mounts `useLumenTelemetry`, which accepts the app name, version, and endpoint.
- Assistant and people API adapters build requests from a caller-supplied base URL.
- People operations such as inviting, updating, revoking, or removing users are exposed as explicit client methods.
Evidence against
- The package has browser network and filesystem-storage behavior, including telemetry and optional persisted query data; these are consistent with its UI and data-cache purpose.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.156",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./ui/*": {
Low
Ai Review Evidence
The manifest describes a React component library and points to `dist/index.js` as its main entry.
package.jsonView on unpkg · L1Findings
1 High1 Medium10 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/people/client.js
LowAi Review Evidencedist/people/client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.156.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.156 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.