@carbon/icons-vue@10.141.0
Vue components for icons in digital and software products using the Carbon Design System
AI Security Review
scanned 8h ago · by lpm-firewall-aiThe package’s postinstall runs telemetry that exports metrics to IBM’s endpoint by default in CI, with an environment-variable opt-out. This is warning-level install-time telemetry, not evidence of malicious exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
The package’s postinstall script invokes the telemetry CLI during installation.
Impact
Installation can send telemetry without an explicit opt-in, though the collector has a documented opt-out.
Mechanism
The CLI starts a background collector in CI unless telemetry is disabled, then exports metrics to IBM’s telemetry endpoint.
AI rationale
The package’s postinstall runs telemetry that exports metrics to IBM’s endpoint by default in CI, with an environment-variable opt-out. This is warning-level install-time telemetry, not evidence of malicious exfiltration.
Evidence
package.jsontelemetry.yml.lpm-dependency-evidence-a39761fe-f9c5-4887-8dab-ef40d44c2d3e/1/npm-linux/dist/collect.js.lpm-dependency-evidence-a39761fe-f9c5-4887-8dab-ef40d44c2d3e/1/npm-linux/dist/spawn-background-process.js.lpm-dependency-evidence-a39761fe-f9c5-4887-8dab-ef40d44c2d3e/1/npm-linux/dist/background-process.jsOS temporary directory: randomized ibmtelemetry log file
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs the IBM telemetry CLI from its postinstall script.
- The telemetry configuration enables npm dependency collection and sends metrics to IBM’s telemetry endpoint.
- The collector runs in CI by default; telemetry can be disabled with IBM_TELEMETRY_DISABLED=true.
Evidence against
- The package is described as Vue icon components, and its entry points load generated icon modules.
- The collector skips export outside CI and provides an environment variable opt-out.
- The configured endpoint belongs to IBM’s telemetry service; the inspected configuration does not enable JavaScript function or token collection.
Behavioral surface
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg30"postinstall": "ibmtelemetry --config=telemetry.yml"
},
"dependencies": {
"@carbon/icon-helpers": "^10.85.0",
"@ibm/telemetry-js": "^1.5.0"
},
"devDependencies": {
Medium
Suspicious Lifecycle Evidence
The package runs the IBM telemetry CLI from its postinstall script.
package.jsonView on unpkg · L30umd/index.jsView file
Findings
1 High8 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumOversized Source Fileumd/index.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Dependency Evidencetelemetry.yml
MediumAi Review Evidence.lpm-dependency-evidence-a39761fe-f9c5-4887-8dab-ef40d44c2d3e/1/npm-linux/dist/spawn-background-process.js
MediumAi Review Evidence.lpm-dependency-evidence-a39761fe-f9c5-4887-8dab-ef40d44c2d3e/1/npm-linux/dist/notify.js
MediumAi Review Evidence.lpm-dependency-evidence-a39761fe-f9c5-4887-8dab-ef40d44c2d3e/1/npm-linux/dist/background-process.js
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to @carbon/icons-vue@10.141.0.
See all versions of @carbon/icons-vue for other recorded verdicts.
- Review the evidence and your use of @carbon/icons-vue@10.141.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.