registry / @columenlabs/lumen-ui / 0.1.169
@columenlabs/lumen-ui@0.1.169
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package exposes React UI components and app-configured API clients. Its telemetry is documented and activated by the consumer mounting the hook, and the reviewed storage behavior is browser-local query caching.
Static reason
No blocking static signals were detected.
Trigger
The consumer calls the API clients or mounts the optional telemetry hook; query persistence is enabled by passing a persist option.
Impact
No evidence of credential collection, unrelated data transfer, or unauthorized account actions.
Mechanism
Clients send requests to app-provided routes. The telemetry hook batches documented first-party app metrics, while query persistence uses browser localStorage.
AI rationale
The package exposes React UI components and app-configured API clients. Its telemetry is documented and activated by the consumer mounting the hook, and the reviewed storage behavior is browser-local query caching.
Evidence
dist/telemetry.jsdist/query-client.js
Network endpoints2
/api/t (telemetry default)caller-supplied API base routes, including /api/assistant and /api/people
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a shared React component library and exports its built entry points.
- Assistant requests use a caller-supplied API base and app routes.
- Telemetry is first-party, documented, and starts when the consumer mounts the telemetry hook; queued fields are limited to route, name, request ID, and device type.
- Query persistence reads and writes app query data in browser localStorage.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.169",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js
Low
Ai Review Evidence
The manifest describes a shared React component library and exports its built entry points.
package.jsonView on unpkg · L1dist/assistant/client.js
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.169.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.169 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.