@carbon/utilities-react@0.31.0
Utilities and helpers to drive consistency across software products using the Carbon Design System with React
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe postinstall invokes the declared IBM telemetry CLI, whose source gates collection to CI and honors IBM_TELEMETRY_DISABLED=true; export has its own opt-out. The configured endpoint and notice align with the package’s IBM telemetry functionality, so the inspected source does not establish an attack.
Decision evidence
public snapshot- package.json runs the declared IBM telemetry CLI during postinstall, using telemetry.yml.
- telemetry.yml configures IBM’s telemetry endpoint and npm dependency and JavaScript token metrics; the collector records dependency names and versions and captures imported tokens.
- The CLI starts the notice and collector. Collection is skipped outside CI or when IBM_TELEMETRY_DISABLED=true, and export has a separate opt-out; the notice describes the telemetry and opt-out.
- The package entrypoints and inspected Carbon utility dependency entrypoints expose utility functions.
Source & flagged code
10 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json runs the declared IBM telemetry CLI during postinstall, using telemetry.yml.
package.jsonView on unpkg · L51Findings
Affected versions and remediation
This report applies to @carbon/utilities-react@0.31.0.
See all versions of @carbon/utilities-react for other recorded verdicts.
- Review the evidence and your use of @carbon/utilities-react@0.31.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.