registry / @carbon/styles / 1.118.0
@carbon/styles@1.118.0
Styles for the Carbon Design System
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe manifest runs telemetry automatically after installation, but the inspected source does not establish what is sent or whether a request occurs. The remaining uncertainty warrants a warning; the inspected runtime entrypoints contain ordinary design-system values and feature-flag handling.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package through a package manager that runs postinstall hooks.
Impact
Installation may disclose telemetry data to the configured endpoint; the reviewed source does not establish the contents or confirm a transfer.
Mechanism
The hook invokes the IBM telemetry CLI with telemetry.yml; the config names the metrics endpoint and lists collection categories without clarifying their effective scope.
AI rationale
The manifest runs telemetry automatically after installation, but the inspected source does not establish what is sent or whether a request occurs. The remaining uncertainty warrants a warning; the inspected runtime entrypoints contain ordinary design-system values and feature-flag handling.
Evidence
package.jsontelemetry.yml
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 73.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs an automatic postinstall telemetry command and its configuration names an IBM metrics endpoint.
- The configuration lists npm dependency collection and token collection as null, so the collected data is unclear from these files.
- The inspected dependency entrypoints contain color constants or environment-based feature flags; they show no attack behavior.
Evidence against
- The reviewed source does not establish what the telemetry command sends or whether it sends data during installation.
- The inspected runtime entrypoints show ordinary design-system values and feature-flag handling.
Behavioral surface
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg32"postinstall": "ibmtelemetry --config=telemetry.yml"
},
"peerDependencies": {
"sass": "^1.33.0"
},
"peerDependenciesMeta": {
"sass": {
"optional": true
}
Medium
Suspicious Lifecycle Evidence
The package runs an automatic postinstall telemetry command and its configuration names an IBM metrics endpoint.
package.jsonView on unpkg · L32Findings
1 High9 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-033ed164-0d11-454c-ae20-5acab6a86fba/0/npm-linux/lib/index.js
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-033ed164-0d11-454c-ae20-5acab6a86fba/0/npm-linux/es/index.js
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-033ed164-0d11-454c-ae20-5acab6a86fba/0/npm-linux/package.json
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-033ed164-0d11-454c-ae20-5acab6a86fba/1/npm-linux/lib/index.js
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-033ed164-0d11-454c-ae20-5acab6a86fba/1/npm-linux/es/index.js
Medium
Affected versions and remediation
This report applies to @carbon/styles@1.118.0.
See all versions of @carbon/styles for other recorded verdicts.
- Review the evidence and your use of @carbon/styles@1.118.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.