LeulAria/Aria-Icons

Review signals: 1 connection review, 1 download and execute, 172 hardcoded secret, 123 known vulnerability, 1 outside write, 1 sensitive read. 8 static matches retained as context.

Reviewed as expected for a test run: read only test files inside the test workspace or its temporary folders; resolver address lookups that send no data; the Bun runtime wrote its own trace marker.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 32 distinct locations. 34 attributed processes.

Source contains download and execute; review its purpose. apps/web/public/install.sh

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 172 findings.

OSV reports a known vulnerability in this dependency version. 24 distinct locations. 123 findings.

Repository processes attempted these writes outside documented output/cache paths. 241 distinct locations. 5 attributed processes.

A repository process attempted to read this sensitive path. <guest-path> 1 attributed processes.

PID 8193: /usr/local/bin/bun · <guest-path>

6 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Icon ids use collection:name, and get_icon returns the icon from its set: Real input produced the expected result: lucide-icons

  Source: Icon ids: `collection:name` (`lucide:house`, `tabler:arrow-up`, `thesvg:github`).

  Input: {"tool": "get_icon", "arguments": {"icon_id": "lucide:house"}}

  Expected: icon from set lucide-icons

  Command: node packages/cli/dist/index.js mcp tools/call {"tool": "get_icon", "arguments": {"icon_id": "lucide:house"}}

  Observed: lucide-icons **Style:** line\n\n## SVG\n\n```svg\n<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8\"/><path d=\"M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z\"/></svg>\n```\n\n## React\n\n```tsx\n// lucide:house\nimport type { SVGProps } from \"react\";\n\nexport function House(props: SVGProps<SVGSVGElement>) {\n return (\n <svg {...p

• get prints SVG for an icon id: Real input produced the expected result: <svg

  Source: | `get <id>` | Print SVG or framework source |

  Input: lucide:house

  Expected: SVG markup

  Command: bun run cli:dev -- get lucide:house

  Observed: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"/><path d="M3 10a2 2 0 0 1 .709-1.528l7-6a2 2 0 0 1 2.582 0l7 6A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/></svg> $ bun run --cwd packages/cli dev get lucide:house $ bun run src/index.ts get lucide:house

• search finds icons by query: Real input produced the expected result: lucide:house

  Source: bun run cli:dev -- search house

  Input: house

  Expected: lucide:house listed among matches

  Command: bun run cli:dev -- search house

  Observed: lucide:house bubbles:house atlas-icons:house famfamfam-silk:house game-icon-pack:house koobiq-icons:house next-icons:house lawnicons:house msr-icons:house semantic-ui-icons:house brightlayer-icons:house moving-icons:house themeisle-icons:house olicons:house small-n-flat:house aksel-icons:house mulberry-symbols:house qgis-icons:house reicon-glass:house iconimate:house mx-icons:house albybarber-bettercons:house andrsrxn-icons:house luceviasicons-luceviasicons:house lyderhansen-splunk-icon-library:house udir-design-icons:house cfpb-cfpb-design-s

• add writes icon files into the repo: Real input produced the expected result: house.vue

  Source: | `add <names…>` | Write icon files into the repo |

  Input: house --framework vue --out-dir .coldpass/claim-add-vue

  Expected: house.vue is written

  Command: node packages/cli/dist/index.js add house --framework vue --out-dir .coldpass/claim-add-vue

  Observed: house.vue lucide:house Import import { House } from "./.coldpass/claim-add-vue" Usage <House />

Examples

• CLI test suite passes: command completed successfully

  Source: README.md Run, build, version, publish (bun run cli:test)

  Input: none

  Expected: all CLI tests pass

  Command: bun run cli:test

  Observed: s [5.00ms] (pass) writeIconFile barrel > force overwrites an existing file [5.00ms] src/agents.test.ts: (pass) getAgentConfigs > returns array of agent configs [1.00ms] (pass) getAgentConfigs > includes expected agents [1.00ms] (pass) getAgentConfigs > each config has required properties [1.00ms] (pass) getAgentConfigs > cursor config path is correct [1.00ms] (pass) getMcpServerConfig > stdio config uses npx aria-icons (pass) getMcpServerConfig > http config uses a url (pass) getOpenCodeMcpConfig > local command array 12 pass 0 fail 57 expect() calls Ran 12 tests across 3 files. [77.00ms]

• CLI bundle builds: command completed successfully

  Source: README.md Run, build, version, publish (bun run cli:build)

  Input: none

  Expected: dist/index.js bundle written

  Command: bun run cli:build

  Observed: Bundled 271 modules in 255ms index.js 0.55 MB (entry point) $ bun run --cwd packages/cli build $ bun build ./src/index.ts --outdir dist --target node --minify --banner:'#!/usr/bin/env node' && chmod +x dist/index.js

• type checks pass: command completed successfully

  Source: README.md Run, build, version, publish (bun run check-types)

  Input: none

  Expected: type check task succeeds

  Command: bun run check-types

  Observed: ath is correct [2.00ms] aria-icons:check-types: (pass) getMcpServerConfig > stdio config uses npx aria-icons [1.00ms] aria-icons:check-types: (pass) getMcpServerConfig > http config uses a url aria-icons:check-types: (pass) getOpenCodeMcpConfig > local command array [1.00ms] aria-icons:check-types: aria-icons:check-types: 12 pass aria-icons:check-types: 0 fail aria-icons:check-types: 57 expect() calls aria-icons:check-types: Ran 12 tests across 3 files. [186.00ms] Tasks: 1 successful, 1 total Cached: 1 cached, 1 total Time: 461ms >>> FULL TURBO $ turbo check-types turbo 2.6.3

Local or hosted: local

Run the aria-icons CLI and its stdio MCP server from the pinned source, search and fetch an icon (get_icon returns lucide:house SVG with set lucide-icons), write an icon file with add, and call the local website /api/v1 search API.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -200; ls -la <guest-path> 2>&1
cd <guest-path> && sed -n 200,400p README.md; echo ----; ls -la .coldpass; echo ----; which node npm bun bunx uv npx 2>&1; node --version 2>&1; npm --version 2>&1; bun --version 2>&1; cat package.json; grep -n '"engines"' -A3 packages/cli/package.json
cd <guest-path> && cat .github/workflows/*.yml 2>/dev/null | head -80; echo ----; cat packages/cli/README.md | head -120; echo; cat bunfig.toml; cat Makefile | head -60
cd <guest-path> && git init -q && git remote add origin https://github.com/LeulAria/Aria-Icons && timeout 170 git fetch --depth 1 origin c1d22bdca5a83921f435a52f2832320538236a62 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1; git status --short | head
sudo -n true && echo SUDO_OK; env | grep -i proxy; (timeout 20 curl -sI https://registry.npmjs.org/aria-icons | head -1); (timeout 20 curl -sI https://github.com | head -1); apt-cache policy nodejs 2>/dev/null | head -3
(sudo apt-get update -qq 2>&1 | tail -3); apt-cache policy nodejs npm 2>/dev/null | head -8
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm >/tmp/apt.log 2>&1; echo apt=$?; node --version; npm --version; export NODE_USE_ENV_PROXY=1; sudo npm install -g [email protected] 2>&1 | tail -3; bun --version
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 bun install 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}
cd <guest-path> && git status --short | head; export NODE_USE_ENV_PROXY=1; timeout 600 bun run cli:test 2>&1 | tail -25; echo rc=${PIPESTATUS[0]}
cd <guest-path> && export NODE_USE_ENV_PROXY=1; timeout 120 bun run cli:dev -- search house 2>&1 | head -20; echo rc=${PIPESTATUS[0]}; echo ----; timeout 120 bun run cli:dev -- get lucide:house 2>&1 | head -12; echo rc=${PIPESTATUS[0]}; echo ----; timeout 120 bun run cli:dev -- doctor 2>&1 | head -20; echo rc=${PIPESTATUS[0]}
cd <guest-path> && ls src; grep -rn "registerTool\|name: \"" src/mcp*.ts src/*mcp* 2>/dev/null | head -30; grep -rln "StdioServerTransport" src | head
cd <guest-path> && grep -n "name\|Tool\|description" src/server.ts | head -60
cd <guest-path> && sed -n 28,40p src/server.ts; sed -n 69,80p src/server.ts; sed -n 160,170p src/server.ts
cd <guest-path> && node -e 'const p=require("./package.json");console.log(JSON.stringify({bin:p.bin,main:p.main,scripts:p.scripts,files:p.files},null,1))'; cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 300 bun run cli:build 2>&1 | tail -8; echo rc=${PIPESTATUS[0]}; ls packages/cli/dist 2>&1; git status --short
cd <guest-path> && export NODE_USE_ENV_PROXY=1; ( printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_icon","arguments":{"icon_id":"lucide:house"}}}'; sleep 8 ) | timeout 30 node packages/cli/dist/index.js mcp 2>/tmp/mcp.err | cut -c1-400; echo rc=$?; head -c 500 /tmp/mcp.err
cd <guest-path> && mkdir -p <guest-path> && cd <guest-path> && export NODE_USE_ENV_PROXY=1; timeout 120 node packages/cli/dist/index.js add house --framework vue --out-dir <guest-path> 2>&1 | head -20; echo rc=${PIPESTATUS[0]}; find <guest-path> -type f | head; cat <guest-path> 2>/dev/null | head -c 600
cd <guest-path> && find . -path ./node_modules -prune -o -name 'house.vue' -print 2>/dev/null; find <guest-path> -print; echo ---; cat tmp/coldpass/outputs/icons-vue/house.vue 2>/dev/null | head -c 400
cd <guest-path> && rm -rf ./tmp && rmdir <guest-path> 2>/dev/null; mkdir -p .coldpass && export NODE_USE_ENV_PROXY=1 && timeout 120 node packages/cli/dist/index.js add house --framework vue --out-dir .coldpass/manual-vue-icons 2>&1 | head -3; echo rc=${PIPESTATUS[0]}; cat .coldpass/manual-vue-icons/house.vue | head -c 200; echo; git status --short
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 600 bun run fetch:thesvg 2>&1 | tail -6; echo rc=${PIPESTATUS[0]}; timeout 900 bun run fetch:iconify -- --all > /tmp/iconify.log 2>&1; echo iconify_rc=$?; tail -5 /tmp/iconify.log
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 bun run generate-icons 2>&1 | tail -6; echo rc=${PIPESTATUS[0]}; cd <guest-path> && git status --short | head -20
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (nohup bun run dev:web > /tmp/devweb.log 2>&1 &) ; for i in $(seq 1 60); do sleep 3; if curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/ 2>/dev/null | grep -q 200; then echo ready_after=$((i*3))s; break; fi; done; tail -5 /tmp/devweb.log; curl -s "http://localhost:3001/api/v1/search?q=house" | head -c 600; echo; curl -s "http://localhost:3001/api/v1/icon?id=lucide:house" | head -c 300
cat /tmp/devweb.log | head -60; echo; cd <guest-path> && cat package.json | head -30
export NODE_USE_ENV_PROXY=1; sudo npm install -g node@22 2>&1 | tail -3; which -a node; node --version; /usr/local/bin/node --version
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (nohup bun run dev:web > /tmp/devweb.log 2>&1 &) ; for i in $(seq 1 60); do sleep 3; c=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/ 2>/dev/null); if [ "$c" = 200 ]; then echo ready_after=$((i*3))s; break; fi; done; echo code=$c; tail -4 /tmp/devweb.log; curl -s "http://localhost:3001/api/v1/search?q=house" | head -c 500; echo; curl -s "http://localhost:3001/api/v1/icon?id=lucide:house" | head -c 300
grep -n "Error\|error" /tmp/devweb.log | grep -v "report this error" | head -15; echo; grep -n "ENOENT\|Cannot\|Failed" /tmp/devweb.log | head -10
pkill -f "next dev" ; pkill -f "turbo -F web dev"; pkill -f "dev:web"; sleep 3; (curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3001/ || true); pgrep -fa "next|turbo" | head -5; echo stopped
for p in $(pgrep -f "next-server|next dev|turbo" 2>/dev/null); do ps -o pid=,args= -p $p; done | grep -v "pgrep" | head; (curl -s -o /dev/null -w '%{http_code}\n' --max-time 5 http://localhost:3001/api/v1/collections || echo down)
cd <guest-path> && export NODE_USE_ENV_PROXY=1; timeout 300 bun run check-types 2>&1 | tail -8; echo rc=${PIPESTATUS[0]}; echo ----; grep -rn "setInterval\|cron\|schedule\|--once\|--now\|webhook\|watch(" packages/cli/src apps/web/src 2>/dev/null | grep -v test | head; echo ----; grep -n "| \`get <id>\`\|Icon ids: \|bun run cli:dev -- search house\|| \`add <names\|cli:test" README.md
cd <guest-path> && git checkout -- bun.lock apps/web/icons/iconify/collections.json && rm -rf .coldpass/manual-vue-icons && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","packages/cli/dist/index.js","mcp"],"cwd":"<guest-path>","tool":"get_icon","arguments":{"icon_id":"lucide:house"},"expected_text":"lucide-icons"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"Icon ids use collection:name, and get_icon returns the icon from its set","source":"Icon ids: `collection:name` (`lucide:house`, `tabler:arrow-up`, `thesvg:github`).","input":"lucide:house","expected":"icon from set lucide-icons","probe_kind":"mcp","argv":["node","packages/cli/dist/index.js","mcp"],"tool":"get_icon","arguments":{"icon_id":"lucide:house"},"expected_text":"lucide-icons","cwd":"<guest-path>"},
{"kind":"claim","claim":"get prints SVG for an icon id","source":"| `get <id>` | Print SVG or framework source |","input":"lucide:house","expected":"SVG markup","probe_kind":"cli","argv":["bun","run","cli:dev","--","get","lucide:house"],"expected_text":"<svg","cwd":"<guest-path>"},
{"kind":"claim","claim":"search finds icons by query","source":"bun run cli:dev -- search house","input":"house","expected":"lucide:house listed among matches","probe_kind":"cli","argv":["bun","run","cli:dev","--","search","house"],"expected_text":"lucide:house","cwd":"<guest-path>"},
{"kind":"claim","claim":"add writes icon files into the repo","source":"| `add <names…>` | Write icon files into the repo |","input":"house --framework vue --out-dir .coldpass/claim-add-vue","expected":"house.vue is written","probe_kind":"cli","argv":["node","packages/cli/dist/index.js","add","house","--framework","vue","--out-dir",".coldpass/claim-add-vue"],"expected_text":"house.vue","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"CLI test suite passes","source":"README.md Run, build, version, publish (bun run cli:test)","input":"none","expected":"all CLI tests pass","argv":["bun","run","cli:test"],"cwd":"<guest-path>","env":{},"expected_text":"12 pass"},
{"kind":"example","claim":"CLI bundle builds","source":"README.md Run, build, version, publish (bun run cli:build)","input":"none","expected":"dist/index.js bundle written","argv":["bun","run","cli:build"],"cwd":"<guest-path>","env":{},"expected_text":"index.js"},
{"kind":"example","claim":"type checks pass","source":"README.md Run, build, version, publish (bun run check-types)","input":"none","expected":"type check task succeeds","argv":["bun","run","check-types"],"cwd":"<guest-path>","env":{},"expected_text":"1 successful"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md, packages/cli/src and apps/web/src for cron, scheduling, loops, webhooks, --once and --now. The CLI and MCP server are one-shot request/response processes; the only setInterval is a UI animation in apps/web/src/components/morph-playground.tsx. CI release workflow schedules are not product cycles.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -c "import json,sys;json.load(open(sys.argv[1]));print('ok',sys.argv[1])" .coldpass/$f.json; done
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the aria-icons CLI and its stdio MCP server from the pinned source, search and fetch an icon (get_icon returns lucide:house SVG with set lucide-icons), write an icon file with add, and call the local website /api/v1 search API.","operation_scope":"Pinned commit c1d22bd on Ubuntu 24.04 (x86_64) with sudo. Requires Node >=18 for the CLI and Node >=20.9 for the website, Bun 1.2.21, and network access to the aria-icons API, GitHub and the Iconify/theSVG icon sources. The CLI operations run against the live production API. The homepage at localhost:3001 was not verified because it returns HTTP 500 (see deviations). No browser was used.","steps":["git init; git remote add origin https://github.com/LeulAria/Aria-Icons; git fetch --depth 1 origin c1d22bdca5a83921f435a52f2832320538236a62; git reset --mixed FETCH_HEAD","sudo apt-get install -y nodejs npm (Node 18.19.1)","sudo npm install -g [email protected]","bun install","bun run cli:test (12 pass)","bun run cli:dev -- search house","bun run cli:dev -- get lucide:house","bun run cli:dev -- doctor","bun run cli:build","node packages/cli/dist/index.js mcp (JSON-RPC tools/call get_icon lucide:house)","node packages/cli/dist/index.js add house --framework vue --out-dir .coldpass/manual-vue-icons","bun run check-types","cd apps/web && bun run fetch:thesvg && bun run fetch:iconify -- --all && bun run generate-icons","sudo npm install -g node@22 (Node 22.23.4 for Next.js)","bun run dev:web; curl http://localhost:3001/api/v1/search?q=house and /api/v1/icon?id=lucide:house","stopped the dev server"],"deviations":["Ubuntu nodejs 18.19.1 is below Next.js 16's required Node 20.9; installed Node 22.23.4 via sudo npm install -g node@22 (NODE_USE_ENV_PROXY=1) for the website step, and used Node 18 for the CLI.","The README gives no bun installer; installed [email protected] (the packageManager pin) with sudo npm install -g [email protected] rather than curl|sh from bun.sh.","bun install rewrote bun.lock; restored it with git checkout to keep the pinned tree clean. node_modules and generated files are untracked.","Iconify fetch rewrote tracked file apps/web/icons/iconify/collections.json; restored with git checkout. Generated icon JSON and icons-meta files are untracked and kept.","Website homepage http://localhost:3001 returns HTTP 500 under bun run dev:web: Turbopack panics with 'Failed to write app endpoint /(browse)/page' (panic logs written to /tmp/next-panic-*.log). The /api/v1/search and /api/v1/icon routes work. Not fixed (product source must not be edited); the browser page is not verified.","aria-icons add with an absolute --out-dir (/tmp/...) wrote the file under the current directory (tmp/coldpass/outputs/icons-vue/house.vue) instead. Used a relative --out-dir under .coldpass instead and removed the stray workspace/tmp directory I created.","Not run: npx -y aria-icons@latest setup and curl install.sh from the CLI README, because they write editor MCP configuration into the user's home and need consent. The MCP probe runs the built source bin instead of the npm package.","bun run cli:dev prints a '$ bun run ...' echo line to stdout, so the MCP probe uses the built dist/index.js bin for a clean stdio stream.","Turbo printed a telemetry notice on first run; I did not change telemetry settings."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Fix the Turbopack panic on the /(browse) route in the Next.js dev server (or document the Next/Turbopack version needed) and make aria-icons add treat absolute --out-dir paths as absolute. Document that the website needs Node 20.9+ and the CLI needs Node 18+."}
EOF
python3 -I -c "import json;d=json.load(open('.coldpass/report.json'));print(d['outcome'],d['fault_owner'])"; ls -la .coldpass; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import sys,json;t=sys.stdin.read();print(t[:300]);d=json.loads(t[:t.rfind('}')+1]) if t.strip().startswith('{') else None;print('VALID', d and d.get('valid'), d and d.get('problems'), d and d.get('replay',{}).get('status'))" ; git status --short