@carbon/icon-helpers — Greenflagged

Helpers used alongside icons for digital and software products using the Carbon Design System

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

ibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @ibm/telemetry-js is IBM's official telemetry lib, added consistently across Carbon packages.	ai	2026/07/20
maintainer-change	maintainer-added	AI (maintainer-change): CI/CD provenance-backed publish; monorepo maintainer churn, not compromise.	ai	2026/07/20
provenance	no-provenance	AI (provenance): Legacy Carbon release; provenance absence is common and benign.	ai	2026/07/20
email-domain	unclaimed-email:loveme.computer	AI (email-domain): Stale maintainer email on an established IBM package; no behavioral risk.	ai	2026/07/20
publish-pattern	dormant-publish	AI (publish-pattern): Carbon Design System monorepo package; publishing cadence varies per sub-package. SLSA provenance attestation confirms official CI/CD pipeline, ruling out account takeover.	ai	2026/04/26
phantom-deps	phantom-dep:@ibm/telemetry-js	AI (phantom-deps): Telemetry is invoked via CLI in postinstall script with a config file, not imported directly in source — this is the expected usage pattern.	ai	2026/04/25
install-scripts	install-script:postinstall	AI (install-scripts): IBM telemetry postinstall is a documented, consistent pattern across all Carbon Design System packages. Not malicious — runs ibmtelemetry with a bundled config file.	ai	2026/04/25
dependencies	unvetted-dep:@ibm/telemetry-js	AI (dependencies): @ibm/telemetry-js is IBM's first-party telemetry package used across the entire Carbon ecosystem; stable dependency for this package.	ai	2026/04/25

Versions (showing 51 of 79)

View all versions

Version	Deps	Published
10.76.0	1 / 3	2026-05-20
10.75.0	1 / 3	2026-04-22
10.74.0	1 / 3	2026-03-25
10.73.0	1 / 3	2026-02-25
10.72.0	1 / 3	2026-02-11
10.71.0	1 / 3	2026-01-28
10.70.0	1 / 3	2025-12-17
10.69.0	1 / 3	2025-12-03
10.68.0	1 / 3	2025-10-08
10.67.0	1 / 3	2025-09-24
10.66.0	1 / 3	2025-09-10
10.65.0	1 / 3	2025-08-27
10.63.0	1 / 3	2025-07-30
10.62.0	1 / 3	2025-07-16
10.61.0	1 / 3	2025-06-18
10.60.0	1 / 3	2025-06-04
10.59.0	1 / 3	2025-05-07
10.57.0	1 / 3	2025-04-09
10.56.0	1 / 3	2025-03-12
10.53.1	1 / 3	2024-10-02
10.52.0	1 / 3	2024-09-12
10.50.0	1 / 3	2024-07-31
10.47.0	1 / 3	2024-03-13
10.46.0	0 / 3	2024-02-02
10.45.1	0 / 3	2023-10-27
10.45.0	0 / 3	2023-10-26
10.44.0	0 / 2	2023-08-03
10.43.1	0 / 2	2023-07-27
10.43.0	0 / 2	2023-07-21
10.42.1	0 / 2	2023-07-07
10.42.0	0 / 2	2023-07-06
10.41.0	0 / 2	2023-06-08
10.40.0	0 / 2	2023-05-25
10.39.0	0 / 2	2023-03-03
10.38.0	0 / 2	2023-01-19
10.37.0	0 / 2	2023-01-05
10.36.0	0 / 2	2022-12-08
10.35.0	0 / 2	2022-12-02
10.34.0	0 / 2	2022-09-29
10.33.0	0 / 2	2022-09-15
10.32.0	0 / 2	2022-08-04
10.31.0	0 / 2	2022-06-09
10.30.0	0 / 2	2022-05-12
10.29.0	0 / 2	2022-03-31
10.28.3	1 / 2	2024-03-11
10.28.2	0 / 2	2023-08-17
10.28.1	0 / 2	2023-07-06
10.28.0	0 / 2	2022-02-25
10.27.0	0 / 2	2022-02-14
10.26.0	0 / 2	2022-01-14
10.25.0	0 / 2	2021-10-28

v10.73.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.69.0

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: carbon-bot → GitHub Actions (on 2025-12-03, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (carbon-bot) on 2025-12-03, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v10.61.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.57.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.56.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.53.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.52.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.50.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.47.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.46.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.45.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.45.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.44.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v10.43.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.42.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.42.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.41.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.28.3

1 finding

HIGH Provenance attestation missing — previous versions had it provenance

This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. Multiple high-profile registry compromises have exhibited exactly this pattern.

v10.28.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.28.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.