registry / @carbon/styles / 1.115.0
@carbon/styles@1.115.0
Styles for the Carbon Design System
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe lifecycle hook is a transparent telemetry invocation whose local configuration disables the sensitive collection categories shown. The remaining shipped content is stylesheet source and generated CSS, with no concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation
Impact
The configuration names an IBM metrics endpoint, but inspected source shows no secret collection, project mutation, or payload execution.
Mechanism
Package-aligned telemetry configuration
AI rationale
The lifecycle hook is a transparent telemetry invocation whose local configuration disables the sensitive collection categories shown. The remaining shipped content is stylesheet source and generated CSS, with no concrete malicious behavior.
Evidence
telemetry.yml
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Installation automatically runs the IBM telemetry command.
Evidence against
- The package is a stylesheet distribution containing CSS and SCSS assets, with no shipped production JavaScript entrypoint.
- The telemetry configuration disables dependency and token collection and declares no JavaScript functions.
- There is no self-dependency, shell payload, credential harvesting, destructive action, or agent-control-surface mutation in the inspected source.
Behavioral surface
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg29"scripts": {
"build": "yarn clean && node tasks/build-css.js",
"clean": "rimraf css",
"postinstall": "ibmtelemetry --config=telemetry.yml"
},
Low
Ai Review Evidence
Installation automatically runs the IBM telemetry command.
package.jsonView on unpkg · L29Findings
1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @carbon/styles@1.115.0.
See all versions of @carbon/styles for other recorded verdicts.
- Review the evidence and your use of @carbon/styles@1.115.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.