@carbon/ai-chat@1.23.1
Be sure to review the [chat documentation](https://chat.carbondesignsystem.com/tag/latest/docs/documents/Overview.html).
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package sends telemetry through a postinstall hook that runs by default, which warrants a warning under the install-time telemetry rule. The inspected config points to IBM’s endpoint and does not show credential or project-data exfiltration.
Decision evidence
public snapshot- An automatic postinstall hook runs `ibmtelemetry --config=telemetry.yml`.
- The telemetry config sends to IBM’s telemetry endpoint and identifies the project.
- The config sets npm dependency collection to null, and no malicious credential or data collection was identified.
- The telemetry endpoint belongs to IBM, the package publisher.
- The configured npm dependency collection is disabled.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgAn automatic postinstall hook runs `ibmtelemetry --config=telemetry.yml`.
package.jsonView on unpkg · L166Findings
Affected versions and remediation
This report applies to @carbon/ai-chat@1.23.1.
See all versions of @carbon/ai-chat for other recorded verdicts.
- Review the evidence and your use of @carbon/ai-chat@1.23.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.