# Security & Socket.dev Alerts

## Published package surface

**`islamic-icons` has zero production dependencies.** When users install the package, they only receive:

- Built icon components in `dist/web` and `dist/native`
- Peer dependencies: `react`, `react-dom` (optional), `react-native-svg` (optional)

So **none of the Socket alerts affect the code that runs in your app** when you use this library. The alerts come from the **development and build dependency tree** (Vite, Storybook, Babel, ESLint, jimp, sharp, SVGO, etc.), which is not published to npm.

## Why Socket shows so many alerts

Socket (and similar tools) analyze the **entire dependency tree** of the repository, including **devDependencies**. In this project, that includes:

- **Build/tooling**: Vite, Babel, TypeScript, vite-plugin-dts, Storybook
- **Image/icon tooling**: jimp, potrace, sharp, SVGO (used for scripts like `generate:icons`, `optimize:svgs`, `png-to-svg`)

Those tools commonly trigger alerts such as:

| Alert | Why it appears |
|-------|----------------|
| **Uses eval** | Bundlers and transpilers (e.g. Babel, Vite) use `eval` or dynamic code execution. |
| **Shell access** | Build scripts and dev tools (e.g. Storybook, Vite) run shell commands. |
| **Network access** | Dev server, hot reload, and some plugins use the network. |
| **Filesystem access** | Build and file-watching tools read/write files. |
| **Environment variable access** | Config and env loading (e.g. `NODE_ENV`, `.env`). |
| **Obfuscated / minified code** | Some dependencies ship minified or bundled code. |
| **Deprecated / Unmaintained** | Transitive devDependencies that are old or deprecated. |
| **URL strings** | In this repo: standard SVG `xmlns="http://www.w3.org/2000/svg"` and lockfile registry URLs; no runtime URL fetching in published code. |

So the alerts are expected for a project that uses modern JS tooling and do **not** indicate malicious behavior in the published package.

## Known CVEs (devDependencies only)

`npm audit` may report vulnerabilities in **devDependencies** (e.g. jimp → file-type/phin, vite-plugin-dts → minimatch, vue-template-compiler). These do **not** run in production for consumers of `islamic-icons`. To reduce dev risk:

1. Run `npm audit` and apply safe fixes: `npm audit fix`.
2. For remaining issues, consider upgrading or replacing dev-only packages when convenient (e.g. upgrading `jimp` or `vite-plugin-dts` when compatible).

## Reporting security issues

If you find a security issue in the **published** code (e.g. in `dist/` or in how the library is consumed), please report it responsibly (e.g. via the repository’s issue tracker or a private channel if the project provides one).