@central-icons-svelte/round-filled-radius-2-stroke-2@1.1.318
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe install-time hook exfiltrates a credential to a network endpoint before the icon package is usable. Although the code resembles license validation, automatic transmission of a secret from the installer is a concrete credential-exfiltration surface. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Decision evidence
public snapshot- A preinstall hook automatically runs license-check.js during dependency installation.
- The hook reads CENTRAL_LICENSE_KEY and sends it as a Bearer token to a remote host.
- The runtime entry point exports Svelte icon components; no additional executable runtime behavior was found.
- The hook has no filesystem, shell, dynamic-code, or persistence operations.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgA preinstall hook automatically runs license-check.js during dependency installation.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.318.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.318 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.