@carbon/utilities-react@0.28.0
Utilities and helpers to drive consistency across software products using the Carbon Design System with React
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe install hook runs the IBM telemetry client with a package-local configuration, and the inspected configuration disables the listed dependency, function, and token collection. The entrypoint exports package utilities; no concrete malicious behavior was found.
Decision evidence
public snapshot- package.json runs the named IBM telemetry client with a package-local config at postinstall.
- telemetry.yml sets an IBM telemetry endpoint and configures no dependency, function, or token collection.
- lib/index.js exposes React utility exports through local modules and @carbon/utilities.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @carbon/utilities-react@0.28.0.
See all versions of @carbon/utilities-react for other recorded verdicts.
- Review the evidence and your use of @carbon/utilities-react@0.28.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.