Package evidence

@carbon/[email protected]

Install-time lifecycle script: postinstall="ibmtelemetry --config=telemetry.yml"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 7,930Niche · −30% score
Versions published: 147Mature · −50% score
First published: Oct 2024
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@carbon/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@carbon/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes1,383,160

Previous version1.15.0-rc.0

Published2026-06-11T19:30:28.814Z

SHA-25647325dd7ca36c906ac08ea316e5682a10d0fe9f25f5e7e04e4ff98a8830de06f

Why flagged

What the scanner saw

Install-time lifecycle script: postinstall="ibmtelemetry --config=telemetry.yml"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

2d agoLast checked

reviewRisk

1Score

1.15.0-rc.1Version

Status history (1 event)

new → available2d ago · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Install-time lifecycle script	package.json	postinstall="ibmtelemetry --config=telemetry.yml"	5

Manifest

Package metadata

Scripts5

buildrollup -c ./tasks/rollup.aichat.js && typedoc
postinstallibmtelemetry --config=telemetry.yml
startconcurrently "rollup -c ./tasks/rollup.aichat.js --watch" "typedoc --watch" "serve dist/docs/carbon-tsdocs -l 5001 --no-port-switching" "wait-on dist/docs/carbon-tsdocs/index.html && open http://localhost:5001"
telemetry:confignpx -y @ibm/telemetry-js-config-generator generate --id ef967584-5788-47d4-b9c2-a60da7ad901d --endpoint https://www-api.ibm.com/ibm-telemetry/v1/metrics --files ./src --wc
testjest --coverage --coverageReporters=text --coverageReporters=text-summary

Dependencies16

@carbon/ai-chat-components^1.5.0-rc.1
@carbon/icons^11.53.0
@ibm/telemetry-js^1.10.2
@lit/react^1.0.6
classnames^2.5.0
color^4.2.3
compute-scroll-into-view^3.1.0
dayjs^1.11.10
focus-trap-react^12.0.0
intl-messageformat^11.0.0
lit^3.1.0
lodash-es^4.18.1
markdown-it^14.1.0
tabbable^6.2.0
tslib^2.6.3
use-sync-external-store^1.2.0