registry / @columenlabs/lumen-ui / 0.1.76
@columenlabs/lumen-ui@0.1.76
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThis is a React component library with no install hooks or executable bin. The network behavior is tied to caller-provided application APIs and same-origin error reporting; the scanner's filter and filesystem signals did not reveal attack behavior.
Static reason
No blocking static signals were detected.
Trigger
Requests occur when an application invokes its API-backed features or reports a client error.
Impact
The app's API receives requested feature traffic and bounded error details, including the current page path and query string.
Mechanism
Browser fetches use caller-supplied API URLs or the same-origin /api/client-error endpoint; no unrelated collector or install-time behavior was found.
AI rationale
This is a React component library with no install hooks or executable bin. The network behavior is tied to caller-provided application APIs and same-origin error reporting; the scanner's filter and filesystem signals did not reveal attack behavior.
Network endpoints2
/api/client-errorcaller-supplied API base (people client documents /api/people)
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes shared React components and points to dist/index.js; it declares no lifecycle scripts or executable bin.
- The main entry is a component export barrel, consistent with the package's UI purpose.
- Network calls use caller-supplied API URLs; the people client exposes user-invoked account operations under an app API base.
- Error diagnostics post error details to the app's same-origin /api/client-error endpoint.
- The flagged filter source describes client-side filtering and contains no network or filesystem API references.
Evidence against
- The package does make browser network requests, including error reports that include the current page path and query string.
- The package contains browser storage and WebSocket usage in UI features.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/lumen-filter.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/lumen-filter.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.76",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js"
Low
Suspicious Lifecycle Evidence
The manifest describes shared React components and points to dist/index.js; it declares no lifecycle scripts or executable bin.
package.jsonView on unpkg · L184"peerDependencies": {
"@tanstack/react-query": "^5.103.2",
"@tanstack/react-router": "^1.170.39",
"react": "^19.0.0",
"react-dom": "^19.0.0"
}
}
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/lumen-filter.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/people/client.js
LowAi Review Evidencedist/route-error.js
LowAi Review Evidencedist/lumen-filter.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.76.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.