@columenlabs/lumen-ui@0.1.180
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 2d ago · by lpm-firewall-aiNo malicious install behavior or credential theft was identified. Runtime diagnostics can send error messages, stacks, and query-string data to the app’s endpoint, and the reviewed source shows no opt-out; this is a telemetry risk.
Static reason
No blocking static signals were detected.
Trigger
When app error handling calls reportError; general telemetry starts when the app mounts useLumenTelemetry.
Impact
Error messages, stack details, and query-string values may contain identifying or sensitive data and are sent with no evident opt-out.
Mechanism
The error reporter posts the error message, stack, and location path and query to /api/client-error; telemetry can also send views, error fingerprints, failed-request details, and Web Vitals to /api/t.
AI rationale
No malicious install behavior or credential theft was identified. Runtime diagnostics can send error messages, stacks, and query-string data to the app’s endpoint, and the reviewed source shows no opt-out; this is a telemetry risk.
Evidence
dist/route-error.jsdist/telemetry.js
Network endpoints2
/api/client-error/api/t
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is a React UI library with no install lifecycle scripts in its manifest.
- Telemetry starts when an app mounts useLumenTelemetry and posts to the app’s configured endpoint, defaulting to /api/t.
- Error reporting sends error messages, stacks, and the current URL including its query string to /api/client-error.
Evidence against
- The assistant client sends requests to a caller-supplied base URL for the package’s own assistant routes.
- Persisted query caching is enabled only when the caller supplies a persist option.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.180",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "modul
Medium
Suspicious Lifecycle Evidence
The package is a React UI library with no install lifecycle scripts in its manifest.
package.jsonView on unpkg · L1dist/telemetry.js
Findings
1 High5 Medium3 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/telemetry.js
MediumAi Review Evidencedist/route-error.js
MediumAi Review Evidencedist/telemetry.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.180.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.180 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.