Loading npm security reports…

@central-icons-svelte/round-outlined-radius-1-stroke-1.5@1.2.1 | LPM Firewall

registry / @central-icons-svelte/round-outlined-radius-1-stroke-1.5 / 1.2.1

@central-icons-svelte/round-outlined-radius-1-stroke-1.5@1.2.1

A collection of round outlined Svelte icons with 1px radius and 1.5px stroke width, designed for use in Svelte applications.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No attack surface was established. The install hook sends the package license key to the vendor license endpoint and icon modules only draw SVG.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall runs license-check.js when the package is installed.

Impact

A missing license key stops install. A present key is disclosed only to the vendor license service. No credential theft, remote payload, or project mutation was found.

Mechanism

If CENTRAL_LICENSE_KEY is set, the script POSTs it to the fixed Central Icons license URL and ignores the response after logging errors. Icon files do not execute network, shell, or file operations.

AI rationale

The preinstall script is a vendor license check for this icon pack: it uses only CENTRAL_LICENSE_KEY and a fixed centralicons.com endpoint, with no file, shell, or agent-config access. Icon sources are static Svelte SVG components, so the behavior stays package-aligned.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Install runs only preinstall node ./license-check.js. Other scripts are build, prepublishOnly, and lint. The sole dependency is a Svelte peer.
license-check.js reads CENTRAL_LICENSE_KEY and throws if it is missing. It does not read other environment variables or files.

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

14"scripts": { "preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build", "lint": "node ./build.mjs" }, "peerDepen

Low

Suspicious Dependency Evidence

Install runs only preinstall node ./license-check.js. Other scripts are build, prepublishOnly, and lint. The sole dependency is a Svelte peer.

package.jsonView on unpkg · L14

Icon3d/Icon3d.svelteView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 397

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Icon3d/Icon3d.svelteView on unpkg

1<script> import CentralIconBase from "../CentralIconBase.svelte"; </script> <CentralIconBase {...$$props} ariaLabel="3d, shaders" maskId="round-outlined-radiu

Low

Ai Review Evidence

Icon3d.svelte only imports CentralIconBase and renders static SVG circles. The package entry re-exports icon components.

Icon3d/Icon3d.svelteView on unpkg · L1

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.320 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment", ); } const

Low

Ai Review Evidence

license-check.js reads CENTRAL_LICENSE_KEY and throws if it is missing. It does not read other environment variables or files.

license-check.jsView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

Lines 1-24json

1{

2 "name": "@central-icons-svelte/round-outlined-radius-1-stroke-1.5",

3 "version": "1.2.1",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "svelte": "./index.js",

8 "types": "./index.d.ts",

9 "exports": {

10 ".": { "types": "./index.d.ts", "svelte": "./index.js", "default": "./index.js" },

11 "./*": { "types": "./*/index.d.ts", "svelte": "./*/*.svelte", "default": "./*/*.svelte" }

12 },

13 "files": ["**/*.svelte", "**/*.js", "**/*.d.ts", "**/*.md", "icons-index.json"],

14 "scripts": {

15 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 "build": "node ./build.mjs",

17 "prepublishOnly": "npm run build",

18 "lint": "node ./build.mjs"

19 },

20 "peerDependencies": { "svelte": ">=4" },

Low

Suspicious Dependency Evidence

Install runs only preinstall node ./license-check.js. Other scripts are build, prepublishOnly, and lint. The sole dependency is a Svelte peer.

package.jsonView on unpkg · L14

21 "keywords": ["svelte", "icons", "svg", "central-icons", "icon-pack"],

22 "author": "Iconists"

23}

24

Icon3d/Icon3d.svelteView file

Lines 1-7text

1<script>

2 import CentralIconBase from "../CentralIconBase.svelte";

3</script>

4<CentralIconBase {...$$props} ariaLabel="3d, shaders" maskId="round-outlined-radius-1-stroke-1.5-Icon3d">

Low

Ai Review Evidence

Icon3d.svelte only imports CentralIconBase and renders static SVG circles. The package entry re-exports icon components.

Icon3d/Icon3d.svelteView on unpkg · L1

5 <circle cx="12" cy="12" r="1.5" fill="currentColor"/><circle cx="12" cy="16" r="1.5" fill="currentColor"/><circle cx="8" cy="8" r="1" fill="currentColor"/><circle cx="4" cy="12" r="1" fill="currentColor"/><circle cx="20" cy="12" r="1" fill="currentColor"/><circle cx="12" cy="4" r="1" fill="currentColor"/><circle cx="12" cy="20" r="1" fill="currentColor"/><circle cx="8" cy="4" r="0.75" fill="currentColor"/><circle cx="16" cy="4" r="0.75" fill="currentColor"/><circle cx="4" cy="4" r="0.5" fill="currentColor"/><circle cx="20" cy="4" r="0.5" fill="currentColor"/><circle cx="4" cy="8" r="0.75" fi ...

6</CentralIconBase>

7

license-check.jsView file

Lines 1-21javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

2

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"