@carbon/colors Apache-2.0 37 versions

@carbon/colors

npm Repository Homepage

Colors for digital and software products using the Carbon Design System

37

Versions

Apache-2.0

License

Yes

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

eyeglass-moduleibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @ibm/telemetry-js is IBM's standard telemetry dep added across Carbon packages.	ai	2026/07/24
publish-pattern	dormant-publish	AI (publish-pattern): Carbon packages migrated to GitHub Actions CI publishing; long gap reflects CI transition, not account takeover.	ai	2026/05/03
maintainer-change	maintainer-removed	AI (maintainer-change): Transition to automated CI publishing explains maintainer removal; SLSA provenance confirms legitimate org-controlled release.	ai	2026/05/03
install-scripts	install-script:postinstall	AI (install-scripts): IBM telemetry postinstall is a documented, stable pattern across all @carbon/* packages.	ai	2026/04/29
typosquat	typosquat.levenshtein:cors	AI (typosquat): Scoped @carbon/ namespace; no plausible typosquat of 'cors'. Levenshtein match is spurious.	ai	2026/04/29
phantom-deps	phantom-dep:@ibm/telemetry-js	AI (phantom-deps): @ibm/telemetry-js is invoked via postinstall CLI, not imported directly; phantom-dep is a stable false positive here.	ai	2026/04/29

Versions (showing 37 of 37)

Version	Deps	Published
11.52.0	1 / 9	2026-05-20
11.51.0	1 / 9	2026-04-22
11.50.0	1 / 7	2026-04-08
11.48.0	1 / 7	2026-02-25
11.45.0	1 / 7	2026-01-13
11.44.0	1 / 7	2025-12-17
11.43.0	1 / 7	2025-12-03
11.38.0	1 / 7	2025-08-13
11.37.0	1 / 7	2025-07-30
11.35.0	1 / 7	2025-06-18
11.33.0	1 / 7	2025-05-07
11.23.0	1 / 7	2024-06-19
11.21.0	1 / 7	2024-03-13
11.20.1	0 / 7	2023-10-27
11.20.0	0 / 7	2023-10-26
11.19.0	0 / 7	2023-08-03
11.18.1	0 / 7	2023-07-27
11.18.0	0 / 7	2023-07-21
11.17.1	0 / 7	2023-07-07
11.17.0	0 / 7	2023-07-06
11.16.0	0 / 7	2023-06-08
11.15.0	0 / 7	2023-05-25
11.14.0	0 / 7	2023-04-13
11.13.0	0 / 7	2023-03-03
11.12.0	0 / 7	2023-01-19
11.11.0	0 / 7	2023-01-05
11.10.0	0 / 7	2022-12-08
11.9.0	0 / 7	2022-12-02
11.8.0	0 / 7	2022-11-11
11.7.0	0 / 7	2022-10-27
11.6.0	0 / 7	2022-09-29
11.5.0	0 / 7	2022-09-15
11.4.0	0 / 7	2022-08-04
11.3.0	0 / 7	2022-06-09
11.2.0	0 / 7	2022-05-12
11.1.0	0 / 7	2022-04-14
11.0.0	0 / 8	2022-03-31

v11.23.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.21.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.20.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.20.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.19.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.18.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.17.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.