registry / @columenlabs/lumen-ui / 0.1.189
@columenlabs/lumen-ui@0.1.189
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 18h ago · by lpm-firewall-aiThis version is a React component package with no install lifecycle scripts. Its reviewed network calls use app API routes, and telemetry is described as app-owned and starts when the application mounts its telemetry hook.
Static reason
No blocking static signals were detected.
Trigger
Telemetry starts when an app mounts the exported telemetry hook; assistant requests occur through the app's assistant client.
Impact
No malicious behavior was found in the reviewed source.
Mechanism
Telemetry sends event batches to a same-origin endpoint by default. Assistant requests go to the configured API base.
AI rationale
This version is a React component package with no install lifecycle scripts. Its reviewed network calls use app API routes, and telemetry is described as app-owned and starts when the application mounts its telemetry hook.
Network endpoints2
/api/t<configured API base>/chat
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a shared React component package and has no lifecycle scripts.
- Telemetry is documented as app telemetry sent to the app's Worker, with a default same-origin `/api/t` endpoint.
- Telemetry starts when the app mounts the `useLumenTelemetry` hook.
- Assistant chat requests use the caller-provided API base and send the message to its `/chat` route.
Evidence against
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.189",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js
Low
Suspicious Lifecycle Evidence
The manifest describes a shared React component package and has no lifecycle scripts.
package.jsonView on unpkg · L1dist/telemetry.js
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/assistant/use-assistant-chat.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.189.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.189 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.