@central-icons-svelte/round-filled-radius-2-stroke-2@1.1.316
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete automatic credential-disclosure path during installation, so it should not be marked clean. The narrowly scoped variable and absence of other hostile primitives make a warning more proportionate than a block.
Decision evidence
public snapshot- Installation automatically runs license-check.js through a preinstall hook.
- The hook reads CENTRAL_LICENSE_KEY and sends it as a Bearer credential to centralicons.com during installation.
- The flagged Icon3d component is ordinary Svelte SVG markup and is unrelated to the install-time network action.
- The hook accesses only a specifically named license variable rather than harvesting environment variables or files.
- No child-process, shell, filesystem-write, dynamic-code, or persistence behavior was found in the JavaScript sources.
- The endpoint and package metadata are nominally aligned with Central Icons licensing, though source alone cannot establish operator trust.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstallation automatically runs license-check.js through a preinstall hook.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.316.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.316 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.