@columenlabs/lumen-ui@0.1.73
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package appears to be a UI library, but it also sends runtime error telemetry containing page location and error details without a visible opt-out. This is a warning-level telemetry concern, not evidence of malicious exfiltration.
Decision evidence
public snapshot- When a page error is reported, the package includes the error message, stack, current path and query string, build name, outcome and reporting location in the payload.
- The package sends that payload by POST to the same-origin `/api/client-error` endpoint.
- The package describes itself as a shared React component library, but the error reporting has no visible user opt-out in the inspected code.
- The manifest identifies the package as a shared React component library and has no lifecycle scripts.
- The main entry point re-exports UI components and utilities.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/lumen-filter.js#virtual:normalized:round1View on unpkgWhen a page error is reported, the package includes the error message, stack, current path and query string, build name, outcome and reporting location in the payload.
dist/route-error.jsView on unpkg · L169Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.73.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.73 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.