@central-icons-svelte/round-filled-radius-2-stroke-2@1.1.321
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe only install-time network behavior uses a service-specific environment credential with a fixed package-aligned licensing endpoint. The inspected component is declarative SVG rendering.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Package preinstall invokes license-check.js.
Impact
No confirmed exfiltration, command execution, persistence, or destructive behavior was found.
Mechanism
The script posts package and version metadata with the configured license key to the fixed license service.
AI rationale
The only install-time network behavior uses a service-specific environment credential with a fixed package-aligned licensing endpoint. The inspected component is declarative SVG rendering.
Evidence
license-check.js
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package metadata runs only the local license-check script during preinstall.
- The license check reads CENTRAL_LICENSE_KEY and sends it as bearer authentication to the fixed centralicons.com license endpoint.
- The required icon component only imports the shared Svelte icon base and renders SVG content.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg13"files": ["**/*.svelte", "**/*.js", "**/*.d.ts", "**/*.md", "icons-index.json"],
"scripts": {
"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build",
"
Low
Ai Review Evidence
package metadata runs only the local license-check script during preinstall.
package.jsonView on unpkg · L13Icon3d/Icon3d.svelteView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 397
High
Findings
3 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis LimitedIcon3d/Icon3d.svelte
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencelicense-check.js
LowAi Review EvidenceIcon3d/Icon3d.svelte
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.321.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.1.321 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.