@carbon/styles@1.119.0
Styles for the Carbon Design System
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe package sends telemetry by default from an install-time hook, which is warning-level telemetry under the review criteria. Its README discloses the collection as de-identified and anonymized and offers an opt-out.
Static reason
One or more suspicious static signals were detected.
Trigger
The package manager runs the postinstall hook during installation.
Impact
Metrics are sent during installation without an active opt-in; the README describes the collection and provides an opt-out.
Mechanism
The hook invokes IBM’s telemetry CLI with telemetry.yml, which configures a project ID and IBM metrics endpoint.
AI rationale
The package sends telemetry by default from an install-time hook, which is warning-level telemetry under the review criteria. Its README discloses the collection as de-identified and anonymized and offers an opt-out.
Evidence
package.jsontelemetry.ymlREADME.md
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook runs `ibmtelemetry --config=telemetry.yml`.
- The config identifies an IBM telemetry endpoint and project ID, with npm dependency and JavaScript metric collection settings.
- The README says telemetry is collected when the package is installed and provides an opt-out.
Evidence against
- The README describes the metrics as de-identified and anonymized, and links to IBM’s telemetry documentation.
- The configured destination is IBM’s telemetry endpoint, consistent with the package’s publisher.
Behavioral surface
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg29"scripts": {
"build": "yarn clean && node tasks/build-css.js",
"clean": "rimraf css",
"postinstall": "ibmtelemetry --config=telemetry.yml"
},
"peerDependencies":
Medium
Suspicious Lifecycle Evidence
The postinstall hook runs `ibmtelemetry --config=telemetry.yml`.
package.jsonView on unpkg · L29telemetry.ymlView file
Findings
1 High4 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Dependency Evidencetelemetry.yml
MediumAi Review EvidenceREADME.md
LowScripts Present
Affected versions and remediation
This report applies to @carbon/styles@1.119.0.
See all versions of @carbon/styles for other recorded verdicts.
- Review the evidence and your use of @carbon/styles@1.119.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.