@carbon/utilities
Utilities and helpers to drive consistency across software products using the Carbon Design System
10
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
carbon-design-systemcarbon-botalisonjosephleechasejeffreychewsstrubbergtay1orjones
Keywords
ibmcarboncarbon-design-systemcarbon-utilities
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Carbon monorepo publishes in batches; dormancy is normal for stable utility packages. | ai | |
| source-diff | obfuscated-file:lib/makeDraggable/makeDraggable.test.js | AI (source-diff): esbuild --minify output per package.json build scripts; stable for this package. | ai | |
| source-diff | obfuscated-file:es/makeDraggable/makeDraggable.test.js | AI (source-diff): esbuild --minify output per package.json build scripts; stable for this package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): New utility modules added in normal feature release; stable growth pattern. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New utility modules (carousel, makeDraggable, etc.) added as expected feature growth. | ai | |
| source-diff | obfuscated-file:lib/carousel/carousel.js | AI (source-diff): esbuild --minify output per build scripts; not malicious obfuscation. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@ibm/telemetry-js | AI (phantom-deps): @ibm/telemetry-js is a runtime dep used via CLI in postinstall, not directly imported in source — stable false positive for this package. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): IBM telemetry postinstall is standard across all Carbon Design System packages; not malicious. | ai |