carbon-components-angular
Next generation components
This report shows the evidence for carbon-components-angular@5.72.5. 0 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 19h ago · by lpm-firewall-aiThe package enables an install-time telemetry hook, which is suspicious under the review rules even though the documentation discloses telemetry and offers an opt-out. The package snapshot does not include the configuration named by the hook, so the exact install-time payload is unconfirmed.
Decision evidence
public snapshot- An enabled postinstall runs `ibmtelemetry --config=telemetry.yml`.
- The package documentation says installation enables IBM Telemetry collection and describes an opt-out.
- The referenced IBM telemetry configuration uses an IBM metrics endpoint and collects npm dependency and JavaScript metrics; the package-level `telemetry.yml` was not present in the inspected files.
- The telemetry is disclosed in the package documentation as de-identified and anonymized, with opt-out instructions.
- The package entry points inspected are generated exports; no unrelated attack behavior was identified.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
Findings
Affected versions and remediation
This report applies to carbon-components-angular@5.72.5.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of carbon-components-angular@5.72.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.