@central-icons-svelte/round-filled-radius-2-stroke-2@1.2.1
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe preinstall script is a vendor license check that sends CENTRAL_LICENSE_KEY only to centralicons.com, and the published entrypoints are static Svelte icon components. No harvesting, remote payload, persistence, or agent control-surface mutation is present.
Decision evidence
public snapshot- package.json only runs node ./license-check.js on preinstall; build and prepublishOnly are not install hooks.
- license-check.js requires CENTRAL_LICENSE_KEY and otherwise throws before any request.
- The only network call posts that key as a bearer token to https://centralicons.com/license/check with this package name and version 1.2.1.
- Icon components are static Svelte SVG wrappers around CentralIconBase with no script execution, file access, or network calls.
- A bundled skill file is an icon catalog and is not invoked by any lifecycle script.
- Invalid-license and network failures inside the fetch are only logged, so the check does not enforce a remote block.
- The skill is installed only if a user later runs the documented skills CLI, not during npm install.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json only runs node ./license-check.js on preinstall; build and prepublishOnly are not install hooks.
package.jsonView on unpkg · L14Findings
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.1.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.