@carbon/colors@11.59.0
Colors for digital and software products using the Carbon Design System
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe automatic telemetry hook and configured endpoint leave the scope and consent of install-time data collection unresolved. The IBM endpoint fits the package publisher, and the inspected runtime entrypoint contains color constants, so the evidence does not support a block.
Decision evidence
public snapshot- Installation automatically runs the ibmtelemetry CLI using the package telemetry configuration.
- The configuration names an IBM metrics endpoint and enables npm dependency collection, but the collected fields and consent behavior are not established by the inspected source.
- The endpoint is on an IBM host, consistent with this IBM Carbon package.
- The inspected runtime entrypoint begins with generated color constants.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstallation automatically runs the ibmtelemetry CLI using the package telemetry configuration.
package.jsonView on unpkg · L42Findings
Affected versions and remediation
This report applies to @carbon/colors@11.59.0.
See all versions of @carbon/colors for other recorded verdicts.
- Review the evidence and your use of @carbon/colors@11.59.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.