@central-icons-svelte/round-filled-radius-2-stroke-2@1.2.19
⚠ Under reviewA collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 15d ago · by lpm-firewall-aiInspected source shows a preinstall license check and Svelte icon exports, with no concrete attack identified. The required clean citation coverage exceeds the 256-citation limit, so the result remains manual review.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installation runs the declared preinstall license check.
Impact
No attack impact was established from these behaviors.
Mechanism
The check sends the configured license key to the package's Central Icons license endpoint; the package entrypoint exports Svelte icon components.
AI rationale
Inspected source shows a preinstall license check and Svelte icon exports, with no concrete attack identified. The required clean citation coverage exceeds the 256-citation limit, so the result remains manual review.
Network endpoints1
centralicons.com
Decision evidence
public snapshotAI called this Manual Review at 65.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs the local license checker during preinstall.
- The checker reads the configured CENTRAL_LICENSE_KEY and posts it to the Central Icons license endpoint.
- The package entrypoint exports Svelte icon components; the flagged Icon3d component imports the shared base and supplies SVG markup.
- The shared base renders SVG markup and assigns an instance identifier on mount.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg15"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build",
"lint": "node ./build.mjs"
},
"peerDependencies": { "svelte
Low
Ai Review Evidence
package.json runs the local license checker during preinstall.
package.jsonView on unpkg · L15Icon3d/Icon3d.svelteView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 397
High
Semantic Analysis Limited
Findings
3 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis LimitedIcon3d/Icon3d.svelte
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.19.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.