registry / @columenlabs/lumen-ui / 0.1.190
@columenlabs/lumen-ui@0.1.190
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 18h ago · by lpm-firewall-aiThe reviewed network and storage behavior matches the package's React UI and app-client purpose. Telemetry is an exported hook documented as first-party and bounded to route, error-class/hash, request, and web-vitals data; no malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Application API requests occur when consumers use the relevant features; telemetry starts when the app mounts useLumenTelemetry; cache persistence requires an explicit persist option.
Impact
No unintended credential collection, unrelated data transfer, or destructive behavior was found in the inspected source.
Mechanism
Uses relative app endpoints for requests and browser localStorage for optional query-cache persistence. Telemetry sends route templates, error classes and stack hashes, request status and IDs, and web-vitals data.
AI rationale
The reviewed network and storage behavior matches the package's React UI and app-client purpose. Telemetry is an exported hook documented as first-party and bounded to route, error-class/hash, request, and web-vitals data; no malicious behavior was found.
Evidence
Browser localStorage
Network endpoints2
/api/t/api/assistant
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a shared React component package and points its main entry to dist/index.js; no lifecycle scripts are declared.
- Query-cache persistence is optional and starts only when createDeskQueryClient receives a persist option.
- Persisted query data is stored in browser localStorage, with a size limit and a per-query opt-out.
- Telemetry is described as first-party app telemetry sent to the app's Worker at /api/t by default; it excludes error messages, URL queries, page text, and typed input.
- Telemetry starts when an application mounts the exported useLumenTelemetry hook, which accepts the app name, route, and optional endpoint.
- Assistant API calls use the caller-provided base URL and relative paths such as /api/assistant.
Evidence against
- The scanner flagged network and filesystem APIs, but inspected uses correspond to app API requests and browser-local cache persistence.
- The package has no install lifecycle scripts, and its main entry re-exports components and helpers rather than initiating a collector on import.
Behavioral surface
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.190",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js
Low
Suspicious Lifecycle Evidence
The manifest describes a shared React component package and points its main entry to dist/index.js; no lifecycle scripts are declared.
package.jsonView on unpkg · L1Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/query-client.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.190.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.190 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.