@carbon/icons-vue@10.140.0
Vue components for icons in digital and software products using the Carbon Design System
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package automatically starts configured telemetry during installation, with collection enabled for CI and no affirmative opt-in shown in the inspected source. Its IBM collector and endpoint are package-aligned, so this supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package in a detected CI environment, unless telemetry is disabled.
Impact
Project metadata may be sent to the configured telemetry endpoint without an affirmative opt-in in the inspected package source.
Mechanism
The postinstall command invokes the IBM telemetry collector with a configuration that enables npm dependency and JavaScript function and token collection.
AI rationale
The package automatically starts configured telemetry during installation, with collection enabled for CI and no affirmative opt-in shown in the inspected source. Its IBM collector and endpoint are package-aligned, so this supports a warning rather than a block.
Evidence
package.jsontelemetry.yml.lpm-dependency-evidence-0bc53633-85cd-4b54-ae52-7191088c1d9b/1/npm-linux/package.json.lpm-dependency-evidence-0bc53633-85cd-4b54-ae52-7191088c1d9b/1/npm-linux/dist/collect.js.lpm-dependency-evidence-0bc53633-85cd-4b54-ae52-7191088c1d9b/1/npm-linux/dist/spawn-background-process.js
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs the telemetry collector from an automatic postinstall hook.
- telemetry.yml configures collection of npm dependencies and JavaScript functions and tokens, sending to IBM’s telemetry endpoint.
- The collector launches a detached background process in CI unless telemetry is disabled.
Evidence against
- The configured endpoint is IBM’s telemetry service, and the collector is from IBM’s telemetry package.
- The collector’s launch is gated on CI detection and can be disabled with an environment variable.
Behavioral surface
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg27"scripts": {
"build": "yarn clean && node tasks/build.js",
"clean": "rimraf es lib",
"postinstall": "ibmtelemetry --config=telemetry.yml"
},
"depen
Medium
Suspicious Lifecycle Evidence
package.json runs the telemetry collector from an automatic postinstall hook.
package.jsonView on unpkg · L27umd/index.jsView file
Findings
1 High8 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumOversized Source Fileumd/index.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Dependency Evidencetelemetry.yml
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-0bc53633-85cd-4b54-ae52-7191088c1d9b/1/npm-linux/package.json
MediumAi Review Evidence.lpm-dependency-evidence-0bc53633-85cd-4b54-ae52-7191088c1d9b/1/npm-linux/dist/collect.js
MediumAi Review Evidence.lpm-dependency-evidence-0bc53633-85cd-4b54-ae52-7191088c1d9b/1/npm-linux/dist/spawn-background-process.js
LowScripts Present
Low
Affected versions and remediation
This report applies to @carbon/icons-vue@10.140.0.
See all versions of @carbon/icons-vue for other recorded verdicts.
- Review the evidence and your use of @carbon/icons-vue@10.140.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.