@carbon/styles
Styles for the Carbon Design System
21
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
carbon-bottay1orjonessstrubberg
Keywords
ibmcarboncarbon-design-systemcomponentsreact
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@ibm/plex | AI (dependencies): IBM's own font package; expected dependency for a Carbon styles package across all versions. | ai | |
| phantom-deps | phantom-dep:@carbon/grid | AI (phantom-deps): SCSS dependency, not a JS import; phantom-dep heuristic is a false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@carbon/type | AI (phantom-deps): SCSS dependency; false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@carbon/colors | AI (phantom-deps): SCSS dependency; false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@carbon/layout | AI (phantom-deps): SCSS dependency; false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@carbon/motion | AI (phantom-deps): SCSS dependency; false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@carbon/themes | AI (phantom-deps): SCSS dependency; false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@carbon/feature-flags | AI (phantom-deps): SCSS dependency; false positive for this CSS-only package. | ai | |
| phantom-deps | phantom-dep:@ibm/plex | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-sans | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-serif | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/telemetry-js | AI (phantom-deps): Used by postinstall script via CLI; not a direct JS import but legitimately used. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-sans-thai | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-sans-arabic | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-sans-hebrew | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-sans-devanagari | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-sans-thai-looped | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| phantom-deps | phantom-dep:@ibm/plex-mono | AI (phantom-deps): Font package referenced in SCSS config; not a JS import. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): IBM telemetry tool used consistently across all Carbon packages; documented, open-source, non-malicious. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 1.107.0 | 17 / 9 | |
| 1.106.0 | 17 / 9 | |
| 1.105.0 | 17 / 9 | |
| 1.104.0 | 17 / 9 | |
| 1.103.0 | 17 / 9 | |
| 1.101.0 | 17 / 9 | |
| 1.99.0 | 17 / 9 | |
| 1.98.0 | 17 / 9 | |
| 1.94.0 | 17 / 9 | |
| 1.93.1 | 17 / 9 | |
| 1.92.0 | 17 / 9 | |
| 1.90.0 | 17 / 9 | |
| 1.88.0 | 17 / 9 | |
| 1.87.0 | 17 / 9 | |
| 1.86.1 | 17 / 9 | |
| 1.84.0 | 17 / 9 | |
| 1.83.0 | 17 / 9 | |
| 1.82.0 | 17 / 9 | |
| 1.81.0 | 17 / 9 | |
| 1.0.1 | 8 / 3 | |
| 1.0.0 | 8 / 3 |
v1.0.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.