← Home

@carbon/motion

npm Repository Homepage

Motion helpers for digital and software products using the Carbon Design System

30
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

ibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Carbon monorepo migrated to GitHub Actions CI publishing; human maintainer removal is expected and stable. ai
publish-pattern dormant-publish AI (publish-pattern): Apparent dormancy reflects CI publisher transition, not account takeover; SLSA provenance confirms legitimate CI origin. ai
install-scripts install-script:postinstall AI (install-scripts): IBM telemetry postinstall is standard across Carbon Design System packages; not malicious. ai
phantom-deps phantom-dep:@ibm/telemetry-js AI (phantom-deps): @ibm/telemetry-js is a declared runtime dependency used via CLI in postinstall, not a direct import — stable false positive. ai

Versions (showing 30 of 30)

Version Deps Published
11.46.0 1 / 4
11.45.0 1 / 4
11.44.0 1 / 4
11.43.0 1 / 2
11.41.0 1 / 2
11.40.0 1 / 2
11.38.0 1 / 2
11.30.0 1 / 2
11.29.0 1 / 2
11.17.0 1 / 2
11.16.1 0 / 2
11.16.0 0 / 2
11.15.0 0 / 2
11.14.1 0 / 2
11.14.0 0 / 2
11.13.1 0 / 2
11.13.0 0 / 2
11.12.0 0 / 2
11.11.0 0 / 2
11.10.0 0 / 2
11.9.0 0 / 2
11.8.0 0 / 2
11.7.0 0 / 2
11.6.0 0 / 2
11.5.0 0 / 2
11.4.0 0 / 2
11.3.0 0 / 2
11.2.0 0 / 2
11.1.0 0 / 2
11.0.0 0 / 2

v11.17.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.16.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.16.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.15.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v11.14.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.13.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.