registry / @columenlabs/lumen-ui / 0.1.195
@columenlabs/lumen-ui@0.1.195
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe flagged network and filesystem references resolve to ordinary UI library behavior: hook-activated app telemetry, assistant requests to a caller-selected API base, and optional browser cache persistence. I found no install-time behavior, unrelated collector, or automatic credential collection.
Static reason
No blocking static signals were detected.
Trigger
Telemetry begins when an application mounts `useLumenTelemetry`; assistant requests occur when the assistant feature is used; query-cache persistence requires an explicit `persist` option.
Impact
Observed data flows support the app’s telemetry, configured assistant, and cache features; no unrelated host, credential harvesting, or hidden automatic action was identified.
Mechanism
Telemetry posts bounded route and diagnostic data to a relative app endpoint by default. Assistant requests use a caller-provided API base. Optional query-cache persistence uses browser localStorage.
AI rationale
The flagged network and filesystem references resolve to ordinary UI library behavior: hook-activated app telemetry, assistant requests to a caller-selected API base, and optional browser cache persistence. I found no install-time behavior, unrelated collector, or automatic credential collection.
Evidence
dist/telemetry.jsdist/assistant/client.jsdist/query-client.js
Network endpoints2
/api/t (default; endpoint can be configured)Caller-provided assistant API base, including its /chat route
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a shared React component library, and its root entry exports UI components and utilities.
- Telemetry starts when an app mounts `useLumenTelemetry`; its default endpoint is the app’s relative `/api/t` route.
- Telemetry routes drop hosts and queries, and reported names and request IDs are restricted to a bounded character set.
- The assistant client builds requests from a caller-supplied API base; no fixed external service host is present in that client.
- Query-cache persistence is enabled only when `createDeskQueryClient` receives a `persist` option.
Evidence against
- The package includes runtime telemetry for screen views, errors, failed requests, and Web Vitals; the source describes the reported fields and collection behavior.
- The assistant feature can send user messages and selected page context to its configured assistant service as part of its intended function.
Behavioral surface
FilesystemNetworkWebSocket
Source & flagged code
6 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgdist/index.jsView file
1// Lumen (the whole component system is Lumen: published as
// `@columenlabs/lumen-ui` for every app): the frame, page, status bar, sidebar building
// blocks, preferences, filter, views, wi
Low
Ai Review Evidence
The package describes itself as a shared React component library, and its root entry exports UI components and utilities.
dist/index.jsView on unpkg · L1dist/telemetry.js
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/query-client.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.195.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.195 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.