@carbon/icons
Icons for digital and software products using the Carbon Design System
4
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones
Keywords
ibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Icon library regularly adds new SVG/source files with each release; large file additions are expected for this package. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): IBM telemetry postinstall is standard across Carbon Design System packages; not malicious. | ai | |
| phantom-deps | phantom-dep:@ibm/telemetry-js | AI (phantom-deps): @ibm/telemetry-js is consumed by the postinstall script at runtime, not imported in source; stable pattern for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @carbon/icons is a well-established IBM scoped package; Levenshtein match to 'cors' is a false positive. | ai |