registry / @central-icons-svelte/square-filled-radius-0-stroke-1.5 / 1.2.1

@central-icons-svelte/square-filled-radius-0-stroke-1.5@1.2.1

A collection of square filled Svelte icons with 0px radius and 1.5px stroke width, designed for use in Svelte applications.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

No attack surface was identified. The only install-time behavior is a vendor license check that sends the product license key to the Central Icons license host, and the published components are static Svelte SVG icons.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall runs license-check.js; icon modules run only when a consumer imports them.

Impact

Install fails only when the license variable is missing. No credential theft, remote code execution, file mutation, or agent-control writes were found.

Mechanism

The script reads CENTRAL_LICENSE_KEY and POSTs it to the hardcoded vendor license endpoint. Icon files render SVG markup through a shared base component.

AI rationale

The preinstall hook is a package-aligned license gate that sends CENTRAL_LICENSE_KEY only to centralicons.com, and the rest of the package is static Svelte icon components. No harvesting, shell execution, remote payload, persistence, or agent-config mutation is present.

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json only runs node ./license-check.js from preinstall; other scripts are build, prepublishOnly, and lint, with a svelte peer dependency and Svelte entrypoints.
license-check.js reads CENTRAL_LICENSE_KEY and throws before any request when that variable is unset.

@central-icons-svelte/square-filled-radius-0-stroke-1.5@1.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code