← Home

@carbon/icon-helpers

npm Repository Homepage

Helpers used alongside icons for digital and software products using the Carbon Design System

14
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

ibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): Carbon Design System monorepo package; publishing cadence varies per sub-package. SLSA provenance attestation confirms official CI/CD pipeline, ruling out account takeover. ai
install-scripts install-script:postinstall AI (install-scripts): IBM telemetry postinstall is a documented, consistent pattern across all Carbon Design System packages. Not malicious — runs ibmtelemetry with a bundled config file. ai
dependencies unvetted-dep:@ibm/telemetry-js AI (dependencies): @ibm/telemetry-js is IBM's first-party telemetry package used across the entire Carbon ecosystem; stable dependency for this package. ai
phantom-deps phantom-dep:@ibm/telemetry-js AI (phantom-deps): Telemetry is invoked via CLI in postinstall script with a config file, not imported directly in source — this is the expected usage pattern. ai

Versions (showing 14 of 14)

Version Deps Published
10.76.0 1 / 3
10.75.0 1 / 3
10.74.0 1 / 3
10.72.0 1 / 3
10.71.0 1 / 3
10.70.0 1 / 3
10.68.0 1 / 3
10.67.0 1 / 3
10.66.0 1 / 3
10.65.0 1 / 3
10.63.0 1 / 3
10.62.0 1 / 3
10.60.0 1 / 3
10.59.0 1 / 3

v10.76.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.75.0

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: ibmtelemetry --config=telemetry.yml

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.74.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.72.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.71.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.70.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.59.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.