@carbon/charts

Carbon Charts component library

Latest 1.27.27

NPMApache-2.0

86%

Total Score

healthy

Frequent releases, recent work from seven contributors, and organization backing outweigh workflow pinning and install-hook gaps.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package declares 14 runtime dependencies, including d3, dompurify, lodash-es, html-to-image, and IBM telemetry.

Lifecycle scripts

The package defines a postinstall lifecycle script, so installation runs publisher-controlled code in the consuming project.

Workflow audit

All 3 workflows were analyzed with no failed files, no untrusted checkouts, and no script injection, but all 7 action references are unpinned and one workflow uses an archived action.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-454830 New @carbon/charts is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.30.10 - 1.27.19.	0.30.10 - 1.27.19	Medium

Package versions

Version	Published	Vulnerabilities
1.27.27	5 Nov 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.26	5 Nov 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.25	29 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.24	28 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.23	23 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.22	21 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.21	5 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.20	16 Sept 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.27.19	8 Sept 2026	0 0 critical, 1 total 0 0 high, 1 total 1 1 medium, 1 total 0 0 low, 1 total
1.27.18	31 Jul 2026	0 0 critical, 1 total 0 0 high, 1 total 1 1 medium, 1 total 0 0 low, 1 total