@carbon/ai-chat@1.22.0
Be sure to review the [chat documentation](https://chat.carbondesignsystem.com/tag/latest/docs/documents/Overview.html).
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe lifecycle warning resolves to an IBM telemetry command with a package-aligned endpoint and bounded configuration. Inspected runtime code supports ordinary chat UI behavior without concrete malicious execution or credential forwarding.
Decision evidence
public snapshot- package.json invokes IBM telemetry using telemetry.yml during postinstall.
- telemetry.yml specifies an IBM metrics endpoint and an attribute collection allowlist.
- The runtime entrypoint renders chat components and reads a namespaced Carbon chat session-storage key.
- Message sending delegates to a caller-configured callback.
- The telemetry dependency implementation is outside this snapshot, so its internal collection behavior was not verified.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json invokes IBM telemetry using telemetry.yml during postinstall.
package.jsonView on unpkg · L160Findings
Affected versions and remediation
This report applies to @carbon/ai-chat@1.22.0.
See all versions of @carbon/ai-chat for other recorded verdicts.
- Review the evidence and your use of @carbon/ai-chat@1.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.