registry / @columenlabs/lumen-ui / 0.1.84
@columenlabs/lumen-ui@0.1.84
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is a React UI library with no install hooks, and its assistant requests use a base supplied by the consuming app. Telemetry is initialized only through an explicitly mounted hook and is described as first-party reporting with limited event data.
Static reason
No blocking static signals were detected.
Trigger
A consuming app mounts the assistant or explicitly mounts useLumenTelemetry; chat and settings requests occur when those features are used.
Impact
No unauthorized data collection, credential exfiltration, or unrelated account action was identified.
Mechanism
Requests go to the caller-provided assistant base. Optional telemetry uses a configurable endpoint, defaulting to /api/t.
AI rationale
The package is a React UI library with no install hooks, and its assistant requests use a base supplied by the consuming app. Telemetry is initialized only through an explicitly mounted hook and is described as first-party reporting with limited event data.
Network endpoints2
Caller-provided assistant base (documented default path /api/assistant)Configurable telemetry endpoint (default path /api/t)
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a React component library and exposes ESM entry points; it contains no lifecycle scripts.
- The assistant client sends requests to a caller-provided base, documented with the default path /api/assistant.
- Chat requests send the user’s message to that assistant endpoint when the chat client is called.
- Telemetry starts only when the consuming app mounts useLumenTelemetry; it uses a configurable endpoint and describes limited, first-party reporting.
Evidence against
- The assistant UI supports saving provider keys and settings, which it sends to the configured assistant backend when the user saves them.
- The package includes telemetry code that can send app events, errors, failed-request details, and Web Vitals after the consuming app opts in by mounting its hook.
Behavioral surface
FilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/assistant/lumen-assistant.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@columenlabs/lumen-ui",
"version": "0.1.84",
"description": "Lumen: shared React components (frame, views, widgets, charts, drawers).",
"license": "MIT",
"type": "module",
"main": "./dist/index.js"
Low
Suspicious Lifecycle Evidence
The manifest describes a React component library and exposes ESM entry points; it contains no lifecycle scripts.
package.jsonView on unpkg · L1Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/assistant/lumen-assistant.js#virtual:normalized:round1
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/assistant/client.js
LowAi Review Evidencedist/telemetry.js
LowAi Review Evidencedist/telemetry.js
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.84.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.84 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.