@carbon/type@11.68.0
Typography for digital and software products using the Carbon Design System
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source is Carbon typography plus a declared IBM telemetry postinstall whose config disables token, dependency, and function collection. No credential harvesting, obfuscation, self-install chain, or agent-surface writes appear in this package.
Decision evidence
public snapshot- package.json names @carbon/type 11.68.0 as Carbon typography, with main lib/index.js, module es/index.js, and sass index.scss, and no bin entry.
- The only lifecycle script is postinstall running ibmtelemetry --config=telemetry.yml, with dependencies limited to @carbon/grid, @carbon/layout, and @ibm/telemetry-js.
- telemetry.yml sets the IBM metrics endpoint and leaves npm dependency collection null, JS functions empty, and tokens null.
- lib/index.js only requires @carbon/layout and builds fluid type styles; searches found no eval, child_process, process.env, or other network code.
- postinstall can invoke the declared IBM telemetry CLI during install, so a metric may be sent if that dependency runs.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json names @carbon/type 11.68.0 as Carbon typography, with main lib/index.js, module es/index.js, and sass index.scss, and no bin entry.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @carbon/type@11.68.0.
See all versions of @carbon/type for other recorded verdicts.
- Review the evidence and your use of @carbon/type@11.68.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.