@central-icons-svelte/round-filled-radius-2-stroke-2
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
This report shows the evidence for @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.23. 1 of 30 known versions is blocked or flagged. The newest version, 1.2.26, is allowed. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s preinstall hook automatically sends an environment credential to an external endpoint without an interactive consent step. Although the endpoint appears to serve the package’s license checks, this is an install-time credential transmission, so block publication.
Decision evidence
public snapshot- The preinstall script automatically runs license-check.js during package installation.
- license-check.js reads CENTRAL_LICENSE_KEY from the environment and sends it as a Bearer token in a POST request to https://centralicons.com/license/check.
- The license check is invoked at module top level without an interactive consent step.
- The credential has a package-specific license name, and the endpoint appears to be the vendor’s license service.
- The request includes the package name and version for license validation.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall script automatically runs license-check.js during package installation.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.23.
The versions list below shows the verdict for each recorded version.
- Avoid installing @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.23. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.