@columenlabs/lumen-ui@0.1.85
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is a React UI library with caller-configured assistant requests. Its telemetry is explicitly activated by an application hook and is documented and implemented to send filtered metrics rather than page content, credentials, or typed input.
Decision evidence
public snapshot- The manifest exposes React component library entry points and no executable bin.
- The assistant client sends requests to a caller-provided base URL.
- Telemetry starts only when an app mounts the explicit useLumenTelemetry hook.
- Telemetry is documented as first-party and excludes page text, typed input, and URL queries.
- Telemetry points are limited to route templates, filtered names and request IDs, device category, status, error class and stack hash, and Web Vitals.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgThe manifest exposes React component library entry points and no executable bin.
package.jsonView on unpkg · L7Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.85.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.85 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.