← Home

@carbon/colors

npm Repository Homepage

Colors for digital and software products using the Carbon Design System

11
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

eyeglass-moduleibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): Carbon packages migrated to GitHub Actions CI publishing; long gap reflects CI transition, not account takeover. ai
maintainer-change maintainer-removed AI (maintainer-change): Transition to automated CI publishing explains maintainer removal; SLSA provenance confirms legitimate org-controlled release. ai
install-scripts install-script:postinstall AI (install-scripts): IBM telemetry postinstall is a documented, stable pattern across all @carbon/* packages. ai
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped @carbon/ namespace; no plausible typosquat of 'cors'. Levenshtein match is spurious. ai
phantom-deps phantom-dep:@ibm/telemetry-js AI (phantom-deps): @ibm/telemetry-js is invoked via postinstall CLI, not imported directly; phantom-dep is a stable false positive here. ai

Versions (showing 11 of 11)

Version Deps Published
11.52.0 1 / 9
11.51.0 1 / 9
11.50.0 1 / 7
11.48.0 1 / 7
11.45.0 1 / 7
11.44.0 1 / 7
11.43.0 1 / 7
11.38.0 1 / 7
11.37.0 1 / 7
11.35.0 1 / 7
11.33.0 1 / 7

v11.52.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.50.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.48.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.45.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.44.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.43.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.38.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.37.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.35.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.33.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.