← Home

@carbon/pictograms-react

npm Repository Homepage
3
Versions
—
License
Yes
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones

Keywords

ibmelementscarboncarbon-elementscarbon-design-systemcomponentsreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
install-scripts install-script:postinstall AI (install-scripts): IBM telemetry postinstall is standard across Carbon packages; declared dependency, not malicious. ai
phantom-deps phantom-dep:@ibm/telemetry-js AI (phantom-deps): @ibm/telemetry-js is a declared runtime dependency invoked via postinstall script, not imported in source code — stable false positive for this package. ai

Versions (showing 3 of 3)

Version Deps Published
11.102.0 3 / 3
11.101.0 3 / 3
11.100.0 3 / 3

v11.102.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.101.0

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: ibmtelemetry --config=telemetry.yml

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.100.0

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: ibmtelemetry --config=telemetry.yml

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.