@central-icons-svelte/round-filled-radius-2-stroke-2@1.1.314
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe only install-time network behavior is a documented, package-aligned license check using its dedicated environment variable. Source inspection found no covert exfiltration, remote code execution, persistence, or automatic AI-agent configuration change.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs the preinstall hook
Impact
License key is disclosed to the package's documented validation endpoint.
Mechanism
bounded HTTPS license-key validation
AI rationale
The only install-time network behavior is a documented, package-aligned license check using its dedicated environment variable. Source inspection found no covert exfiltration, remote code execution, persistence, or automatic AI-agent configuration change.
Evidence
package.jsonlicense-check.jsREADME.mdskills/central-icons-svelte/SKILL.mdCentralIconBase.svelteIconRobinhood/IconRobinhood.svelte
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- npm preinstall executes license-check.js.
- The hook sends CENTRAL_LICENSE_KEY as Bearer auth to centralicons.com.
Evidence against
- README documents setting this specific key before installation.
- The hook is a bounded license validation request with package/version metadata.
- Only executable primitive found is the license-check hook; components are static Svelte SVG renderers.
- AI-assistant skill installation requires an explicit npx skills add command; no agent files are written by package code.
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Oversized source lightweight scan
icons/index.js2.20 MB file, sampled 256 KB
Minified
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg14"scripts": {
"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
Low
license-check.jsView file
13try {
const response = await fetch("https://centralicons.com/license/check", {
method: "POST",
headers: {
Authorization: `Bearer ${licenseKey}`,
},
body: JSON.stringify({
package: "central-icons-svelte/round-filled-radius-2-stroke-2",
version: "1.1.314",
}),
Findings
1 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencelicense-check.js
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.314.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.314 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.