carbon-components-angular@5.72.5
Next generation components
AI Security Review
scanned 18h ago · by lpm-firewall-aiThe package enables an install-time telemetry hook, which is suspicious under the review rules even though the documentation discloses telemetry and offers an opt-out. The package snapshot does not include the configuration named by the hook, so the exact install-time payload is unconfirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation invokes the postinstall script.
Impact
Install-time telemetry may be sent to IBM. The available configuration references anonymized metrics, and no credential or project-data collection was identified.
Mechanism
The script calls IBM Telemetry with a telemetry.yml configuration. The package documents telemetry collection and an opt-out; the package-level configuration file was not found, so the precise behavior of this hook could not be confirmed from the package snapshot.
AI rationale
The package enables an install-time telemetry hook, which is suspicious under the review rules even though the documentation discloses telemetry and offers an opt-out. The package snapshot does not include the configuration named by the hook, so the exact install-time payload is unconfirmed.
Evidence
package.jsondocs/documentation/index.html.lpm-dependency-evidence-9b56c88a-ff96-450b-afea-8cabb199af5d/0/npm-linux/telemetry.yml
Network endpoints1
www-api.ibm.com/ibm-telemetry/v1/metrics
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- An enabled postinstall runs `ibmtelemetry --config=telemetry.yml`.
- The package documentation says installation enables IBM Telemetry collection and describes an opt-out.
- The referenced IBM telemetry configuration uses an IBM metrics endpoint and collects npm dependency and JavaScript metrics; the package-level `telemetry.yml` was not present in the inspected files.
Evidence against
- The telemetry is disclosed in the package documentation as de-identified and anonymized, with opt-out instructions.
- The package entry points inspected are generated exports; no unrelated attack behavior was identified.
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = ibmtelemetry --config=telemetry.yml
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = ibmtelemetry --config=telemetry.yml
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdocs/documentation/js/libs/d3.v3.min.jsView file
1// From d3-flextree
L2: !function(){function n(n){return n&&(n.ownerDocument||n.document||n).documentElement}function t(n){return n&&(n.ownerDocument&&n.ownerDocument.defaultView||n.document&&n||n.default...
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
2 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddocs/storybook/5478.2afcabcf.iframe.bundle.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredocs/documentation/js/libs/htmlparser.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedocs/documentation/js/search/search_index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldocs/documentation/js/libs/d3.v3.min.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to carbon-components-angular@5.72.5.
See all versions of carbon-components-angular for other recorded verdicts.
- Review the evidence and your use of carbon-components-angular@5.72.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.