@central-icons-svelte/round-filled-radius-0-stroke-1@1.2.8: Clean | LPM Firewall

Loading npm security reports…

@central-icons-svelte/round-filled-radius-0-stroke-1@1.2.8: Clean | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"svelte": "./index.js", "types": "./index.d.ts", "exports": { ".": { "types": "./index.d.ts", "svelte": "./index.js", "default": "./index.js" }, "./*": { "types": "./*/index.d.ts", "svelte": "./*/*.svelte", "default": "./*/*.svelte" } }, "files": ["**/*.svelte", "**/*.js", "**/*.d.ts", "**/*.md", "icons-index.json"], "scripts": { "preinstall": "node ./license-check.js", "build": "node ./bu

Low

Suspicious Lifecycle Evidence

The package entry point exports Svelte icon components, and the install hook runs a license check.

package.jsonView on unpkg · L7

Icon3d/Icon3d.svelteView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 397

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Icon3d/Icon3d.svelteView on unpkg

1<script> import CentralIconBase from "../CentralIconBase.svelte"; </script> <CentralIconBase {...$$props} ariaLabel="3d, shaders" maskId="round-filled-radius-

Low

Ai Review Evidence

The flagged Icon3d component imports the shared icon base and supplies SVG icon markup.

Icon3d/Icon3d.svelteView on unpkg · L1

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.320 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment", ); } const licenseCheck = async () => { const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), 5000); try { const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, }, body: JSON.stringify({ package: "central-icons-svelte/round-filled-

Low

Ai Review Evidence

The license check reads CENTRAL_LICENSE_KEY and sends it to centralicons.com with this package name and version.

license-check.jsView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

Lines 1-24json

1{

2 "name": "@central-icons-svelte/round-filled-radius-0-stroke-1",

3 "version": "1.2.8",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "svelte": "./index.js",

8 "types": "./index.d.ts",

9 "exports": {

10 ".": { "types": "./index.d.ts", "svelte": "./index.js", "default": "./index.js" },

11 "./*": { "types": "./*/index.d.ts", "svelte": "./*/*.svelte", "default": "./*/*.svelte" }

12 },

13 "files": ["**/*.svelte", "**/*.js", "**/*.d.ts", "**/*.md", "icons-index.json"],

14 "scripts": {

15 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 "build": "node ./build.mjs",

Low

Suspicious Lifecycle Evidence

The package entry point exports Svelte icon components, and the install hook runs a license check.

package.jsonView on unpkg · L7

17 "prepublishOnly": "npm run build",

18 "lint": "node ./build.mjs"

19 },

20 "peerDependencies": { "svelte": ">=4" },

21 "keywords": ["svelte", "icons", "svg", "central-icons", "icon-pack"],

22 "author": "Iconists"

23}

24

Icon3d/Icon3d.svelteView file

Lines 1-7text

1<script>

2 import CentralIconBase from "../CentralIconBase.svelte";

3</script>

4<CentralIconBase {...$$props} ariaLabel="3d, shaders" maskId="round-filled-radius-0-stroke-1-Icon3d">

Low

Ai Review Evidence

The flagged Icon3d component imports the shared icon base and supplies SVG icon markup.

Icon3d/Icon3d.svelteView on unpkg · L1

5 <path d="M13.5 12C13.5 12.8284 12.8284 13.5 12 13.5C11.1716 13.5 10.5 12.8284 10.5 12C10.5 11.1716 11.1716 10.5 12 10.5C12.8284 10.5 13.5 11.1716 13.5 12Z" fill="currentColor"/><path d="M13.5 16C13.5 16.8284 12.8284 17.5 12 17.5C11.1716 17.5 10.5 16.8284 10.5 16C10.5 15.1716 11.1716 14.5 12 14.5C12.8284 14.5 13.5 15.1716 13.5 16Z" fill="currentColor"/><path d="M9 8C9 8.55228 8.55228 9 8 9C7.44772 9 7 8.55228 7 8C7 7.44772 7.44772 7 8 7C8.55228 7 9 7.44772 9 8Z" fill="currentColor"/><path d="M5 12C5 12.5523 4.55228 13 4 13C3.44772 13 3 12.5523 3 12C3 11.4477 3.44772 11 4 11C4.55228 11 5 11.44 ...

6</CentralIconBase>

7

license-check.jsView file

Lines 1-21javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

2

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"