@central-icons-svelte/round-filled-radius-2-stroke-2@1.2.3
A collection of round filled Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports ordinary license authentication and SVG rendering. The scanner fingerprint and parsing failures do not establish malicious behavior, and no concrete attack chain was found.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installation activates the license check; importing components activates ordinary Svelte rendering.
Impact
No confirmed credential theft, payload execution, persistence, or destructive behavior was established.
Mechanism
The hook sends the supplied license key and package identity to a fixed validation endpoint without executing returned code or modifying files.
AI rationale
Inspected source supports ordinary license authentication and SVG rendering. The scanner fingerprint and parsing failures do not establish malicious behavior, and no concrete attack chain was found.
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The preinstall hook runs license-check.js; the manifest has no runtime self-dependency.
- Icon3d/Icon3d.svelte imports the shared rendering component and contains SVG paths.
- license-check.js authenticates to the fixed Central Icons license validation endpoint.
- The credential comes only from CENTRAL_LICENSE_KEY, rather than harvested files or unrelated service sessions.
- The shared component assigns SVG mask identifiers and renders caller-provided icon properties.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg15"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build",
"lint": "node ./build.mjs"
},
"peerDependencies": { "svelte"
Low
Suspicious Lifecycle Evidence
The preinstall hook runs license-check.js; the manifest has no runtime self-dependency.
package.jsonView on unpkg · L15Icon3d/Icon3d.svelteView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 397
High
Findings
3 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis LimitedIcon3d/Icon3d.svelte
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review EvidenceIcon3d/Icon3d.svelte
LowAi Review Evidencelicense-check.js
Affected versions and remediation
This report applies to @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.3.
See all versions of @central-icons-svelte/round-filled-radius-2-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-svelte/round-filled-radius-2-stroke-2@1.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.