@carbon/colors@11.58.0
Colors for digital and software products using the Carbon Design System
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic telemetry hook creates a concrete privacy-relevant network path, but the inspected package source shows no payload execution, credential theft, persistence, or destructive behavior. This warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs the postinstall lifecycle hook.
Impact
Consumer dependency metadata may be sent to IBM without an explicit package-level opt-in.
Mechanism
Automatic telemetry collection and metrics submission.
AI rationale
The automatic telemetry hook creates a concrete privacy-relevant network path, but the inspected package source shows no payload execution, credential theft, persistence, or destructive behavior. This warrants a warning rather than a block.
Evidence
package.jsontelemetry.yml
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Installation automatically runs the IBM telemetry command.
- Its telemetry configuration collects npm dependency metadata and names an IBM metrics endpoint.
Evidence against
- The runtime library files contain static color values and exports, with no network, shell, file, or dynamic-code primitives.
- No self-dependency, payload loader, persistence logic, or destructive behavior is present in the package source.
Behavioral surface
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg38"scripts": {
"build:types": "tsc -p tsconfig.types.json",
"build": "yarn clean && carbon-cli bundle src/index.ts --name CarbonColors && node tasks/build.js && yarn build:types && carbon-cli check \"scss/*.scss\"",
"clean": "rimraf css es lib umd scss index.scss",
"postinstall": "ibmtelemetry --config=telemetry.yml"
}
Medium
Ai Review Evidence
Installation automatically runs the IBM telemetry command.
package.jsonView on unpkg · L38Findings
1 High3 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAi Review Evidencepackage.json
MediumSuspicious Dependency Evidencetelemetry.yml
LowScripts Present
Affected versions and remediation
This report applies to @carbon/colors@11.58.0.
See all versions of @carbon/colors for other recorded verdicts.
- Review the evidence and your use of @carbon/colors@11.58.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.