@carbon/layout@11.59.0
Layout helpers for digital and software products using the Carbon Design System
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malware: the inspected package contains no payload execution, persistence, credential access, or destructive behavior. However, it performs automatic network telemetry at install time, so it warrants a non-blocking warning.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package with lifecycle scripts enabled.
Impact
May transmit dependency-related installation metrics to IBM; no credential theft, destructive action, or remote code execution is established.
Mechanism
Automatic telemetry submission during postinstall.
AI rationale
This is not malware: the inspected package contains no payload execution, persistence, credential access, or destructive behavior. However, it performs automatic network telemetry at install time, so it warrants a non-blocking warning.
Evidence
package.jsontelemetry.yml
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Installation automatically runs an IBM telemetry command.
- Telemetry is configured to send metrics to an IBM endpoint and includes npm dependency collection settings.
Evidence against
- The shipped JavaScript entrypoints contain layout constants and unit-conversion helpers only.
- No package source invokes shells, evaluates code, harvests credentials, writes files, or loads remote payloads.
- There is no self-dependency or AI-agent control-surface behavior.
Behavioral surface
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg33"scripts": {
"build:types": "tsc -p tsconfig.types.json",
"build": "yarn clean && carbon-cli bundle src/index.ts --name CarbonLayout && node tasks/build.mjs && yarn build:types",
"clean": "rimraf es lib umd scss/generated",
"postinstall": "ibmtelemetry --config=telemetry.yml"
},
Medium
Ai Review Evidence
Installation automatically runs an IBM telemetry command.
package.jsonView on unpkg · L33telemetry.yml
Findings
1 High3 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAi Review Evidencepackage.json
MediumSuspicious Dependency Evidencetelemetry.yml
LowScripts Present
Affected versions and remediation
This report applies to @carbon/layout@11.59.0.
See all versions of @carbon/layout for other recorded verdicts.
- Review the evidence and your use of @carbon/layout@11.59.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.