registry / @central-icons-svelte/square-filled-radius-0-stroke-1 / 1.1.310

@central-icons-svelte/square-filled-radius-0-stroke-1@1.1.310

A collection of square filled Svelte icons with 0px radius and 1px stroke width, designed for use in Svelte applications.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

npm install runs a license-key validation request. No confirmed malicious attack surface was found beyond this package-aligned license check.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

A supplied CENTRAL_LICENSE_KEY is sent to the Central Icons license endpoint; no other harvesting, writes, or execution chain was found.

Mechanism

POSTs the explicitly named license environment variable for validation

AI rationale

The install-time network use is a disclosed, narrowly scoped license validation tied to this Central Icons package. Source inspection found no concrete malicious behavior or follow-on payload, persistence, exfiltration beyond the supplied license key, or destructive action.

Evidence

package.jsonlicense-check.jsindex.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

Install hook runs license-check.js.
Hook reads CENTRAL_LICENSE_KEY.
It POSTs that supplied key to centralicons.com.

Evidence against

The request is a named license-validation flow for this Central Icons package and includes only package/version metadata.
No child-process, dynamic-code, filesystem-write, payload-loading, or AI-agent-control code was found in the package's three JavaScript files.
Runtime entrypoint is an export-only Svelte icon index.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 1.65 MB of source, external domains: centralicons.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-24json

2 "name": "@central-icons-svelte/square-filled-radius-0-stroke-1",

3 "version": "1.1.310",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "svelte": "./index.js",

8 "types": "./index.d.ts",

9 "exports": {

10 ".": { "types": "./index.d.ts", "svelte": "./index.js", "default": "./index.js" },

11 "./*": { "types": "./*/index.d.ts", "svelte": "./*/*.svelte", "default": "./*/*.svelte" }

12 },

13 "files": ["**/*.svelte", "**/*.js", "**/*.d.ts", "**/*.md", "icons-index.json"],

14 "scripts": {

15 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 "build": "node ./build.mjs",

17 "prepublishOnly": "npm run build",

Low

Suspicious Lifecycle Evidence

Install hook runs license-check.js.

package.jsonView on unpkg · L14

18 "lint": "node ./build.mjs"

19 },

20 "peerDependencies": { "svelte": ">=4" },

21 "keywords": ["svelte", "icons", "svg", "central-icons", "icon-pack"],

22 "author": "Iconists"

23}

license-check.jsView file

Lines 1-34javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

14"scripts": { "preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build",

Low

Suspicious Lifecycle Evidence

Install hook runs license-check.js.

package.jsonView on unpkg · L14

license-check.jsView file

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment",

Low

Ai Review Evidence

Hook reads CENTRAL_LICENSE_KEY.

license-check.jsView on unpkg · L1

14const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, }, body: JSON.stringify({ package: "central-icons-svelte/square-filled-radius-0-stroke-1", version: "1.1.310", }),

Low

Ai Review Evidence

It POSTs that supplied key to centralicons.com.

license-check.jsView on unpkg · L14

Findings

1 High2 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencelicense-check.js

Affected versions and remediation

This report applies to @central-icons-svelte/square-filled-radius-0-stroke-1@1.1.310.

See version security history for other recorded verdicts.

Review the evidence and your use of @central-icons-svelte/square-filled-radius-0-stroke-1@1.1.310 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-15 12:58:05.658Z (UTC).