registry / @central-icons-svelte/round-outlined-radius-2-stroke-2 / 1.2.2

@central-icons-svelte/round-outlined-radius-2-stroke-2@1.2.2

A collection of round outlined Svelte icons with 2px radius and 2px stroke width, designed for use in Svelte applications.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No attack was identified. The install hook validates a vendor license key, and the inspected runtime components render icons.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall activates the license check; component imports activate icon rendering.

Impact

Installation requires a license key, which is sent to its intended vendor service. No confirmed credential theft or other attack surface was established.

Mechanism

A fixed HTTPS endpoint receives CENTRAL_LICENSE_KEY and package metadata for license validation; no malicious execution or file mutation was found.

AI rationale

Direct inspection shows ordinary vendor license validation and Svelte icon rendering. The fingerprint alert and parser limitations do not establish malicious behavior, and the inspected source contains no concrete attack chain.

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json runs license-check.js at preinstall and has no runtime self-dependency.
Icon3d/Icon3d.svelte imports the shared icon component and renders SVG circles.
license-check.js sends a license key to the fixed vendor license-check endpoint.
The credential comes only from CENTRAL_LICENSE_KEY; no unrelated credential harvesting was found.
CentralIconBase.svelte manages SVG rendering and instance identifiers.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 1.96 MB of source, external domains: centralicons.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-24json

2 "name": "@central-icons-svelte/round-outlined-radius-2-stroke-2",

3 "version": "1.2.2",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "svelte": "./index.js",

8 "types": "./index.d.ts",

9 "exports": {

10 ".": { "types": "./index.d.ts", "svelte": "./index.js", "default": "./index.js" },

11 "./*": { "types": "./*/index.d.ts", "svelte": "./*/*.svelte", "default": "./*/*.svelte" }

12 },

13 "files": ["**/*.svelte", "**/*.js", "**/*.d.ts", "**/*.md", "icons-index.json"],

14 "scripts": {

15 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 "build": "node ./build.mjs",

17 "prepublishOnly": "npm run build",

18 "lint": "node ./build.mjs"

19 },

20 "peerDependencies": { "svelte": ">=4" },

Low

Suspicious Dependency Evidence

package.json runs license-check.js at preinstall and has no runtime self-dependency.

package.jsonView on unpkg · L15

21 "keywords": ["svelte", "icons", "svg", "central-icons", "icon-pack"],

22 "author": "Iconists"

23}

Icon3d/Icon3d.svelteView file

Lines 1-7text

1<script>

2 import CentralIconBase from "../CentralIconBase.svelte";

3</script>

4<CentralIconBase {...$$props} ariaLabel="3d, shaders" maskId="round-outlined-radius-2-stroke-2-Icon3d">

5 <circle cx="12" cy="12" r="1.5" fill="currentColor"/><circle cx="12" cy="16" r="1.5" fill="currentColor"/><circle cx="8" cy="8" r="1" fill="currentColor"/><circle cx="4" cy="12" r="1" fill="currentColor"/><circle cx="20" cy="12" r="1" fill="currentColor"/><circle cx="12" cy="4" r="1" fill="currentColor"/><circle cx="12" cy="20" r="1" fill="currentColor"/><circle cx="8" cy="4" r="0.75" fill="currentColor"/><circle cx="16" cy="4" r="0.75" fill="currentColor"/><circle cx="4" cy="4" r="0.5" fill="currentColor"/><circle cx="20" cy="4" r="0.5" fill="currentColor"/><circle cx="4" cy="8" r="0.75" fi ...

Low

Ai Review Evidence

Icon3d/Icon3d.svelte imports the shared icon component and renders SVG circles.

Icon3d/Icon3d.svelteView on unpkg · L1

6</CentralIconBase>

license-check.jsView file

Lines 1-34javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment",

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build", "lint": "node ./build.mjs" }, "peerDependencies":

Low

Suspicious Dependency Evidence

package.json runs license-check.js at preinstall and has no runtime self-dependency.

package.jsonView on unpkg · L15

Icon3d/Icon3d.svelteView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 397

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Icon3d/Icon3d.svelteView on unpkg

1<script> import CentralIconBase from "../CentralIconBase.svelte"; </script> <CentralIconBase {...$$props} ariaLabel="3d, shaders" maskId="round-outlined-radius-2-stroke-2-Icon3d"> <circle

Low

Ai Review Evidence

Icon3d/Icon3d.svelte imports the shared icon component and renders SVG circles.

Icon3d/Icon3d.svelteView on unpkg · L1

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.320 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

14const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, }, body: JSON.stringify({

Low

Ai Review Evidence

license-check.js sends a license key to the fixed vendor license-check endpoint.

license-check.jsView on unpkg · L14

Findings

3 High2 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis LimitedIcon3d/Icon3d.svelte

HighKnown Malware Source Fingerprint Signaturelicense-check.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LowNo License

LowSuspicious Dependency Evidencepackage.json

LowAi Review EvidenceIcon3d/Icon3d.svelte

LowAi Review Evidencelicense-check.js

Affected versions and remediation

This report applies to @central-icons-svelte/round-outlined-radius-2-stroke-2@1.2.2.

See version security history for other recorded verdicts.

Review the evidence and your use of @central-icons-svelte/round-outlined-radius-2-stroke-2@1.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 12:22:44.510Z (UTC).