{
  "schemaVersion": 1,
  "type": "resource",
  "id": "phosphor-icons",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "local-fixture",
      "source-review"
    ],
    "summary": "Pinned Phosphor core 2.1.1 regular, bold and duotone Check Circle SVGs rendered at 24 px and inherited the wrapper’s color. Three bounded SVG scans found no selected active-content patterns. Labels and hidden semantics were authored by the fixture.",
    "reportUrl": "/design-evaluations/resource-phosphor-icons.json",
    "identity": {
      "target": "@phosphor-icons/core",
      "version": "2.1.1",
      "integrity": "sha512-v4ARvrip4qBCImOE5rmPUylOEK4iiED9ZyKjcvzuezqMaiRASCHKcRIuvvxL/twvLpkfnEODCOJp5dM4eZilxQ=="
    },
    "environment": [
      "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.",
      "Synthetic inputs only; no uploads, purchases, accounts or private data.",
      "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee."
    ],
    "tests": [
      {
        "name": "Three SVG weights render",
        "mode": "local-fixture",
        "method": "Render pinned regular/bold/duotone Check Circle assets in authored wrapper",
        "result": "pass",
        "observation": "[{\"weight\":\"regular\",\"viewBox\":\"0 0 256 256\",\"width\":24,\"fill\":\"rgb(30, 64, 175)\",\"paths\":1,\"hidden\":\"true\",\"scripts\":0,\"events\":0,\"externalRefs\":0},{\"weight\":\"bold\",\"viewBox\":\"0 0 256 256\",\"width\":24,\"fill\":\"rgb(30, 64, 175)\",\"paths\":1,\"hidden\":\"true\",\"scripts\":0,\"events\":0,\"externalRefs\":0},{\"weight\":\"duotone\",\"viewBox\":\"0 0 256 256\",\"width\":24,\"fill\":\"rgb(30, 64, 175)\",\"paths\":2,\"hidden\":\"true\",\"scripts\":0,\"events\":0,\"externalRefs\":0}]"
      },
      {
        "name": "currentColor and accessible wrapper",
        "mode": "local-fixture",
        "method": "Read inherited color and authored button name",
        "result": "pass",
        "observation": "Three SVGs inherit the authored color; the wrapper supplies Confirm and aria-hidden. The raw assets alone do not define a control."
      },
      {
        "name": "Bounded SVG active-content scan",
        "mode": "source-review",
        "method": "Inspect these three parsed SVGs for script/foreignObject/event attributes/HTTP references",
        "result": "pass",
        "observation": "Zero matched patterns in three selected SVGs. Not a sanitizer or a claim about every icon."
      },
      {
        "name": "Framework and design-tool integration",
        "mode": "local-fixture",
        "method": "Use a framework wrapper or design plugin",
        "result": "not-run",
        "observation": "The fixture rendered raw SVG assets only; no integration package or plugin was installed."
      }
    ],
    "security": {
      "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Three selected SVGs were self-contained in the fixture",
          "detail": "The sampled SVGs rendered without external requests. No script, foreignObject, event attribute or HTTP-reference pattern matched in those files; this is a small sample, not a sanitizer."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "An asset is not an interactive control",
          "detail": "Wrap actionable icons in native controls and supply understandable labels, focus states and adequate targets. Changing an icon’s weight alone may not communicate a status to everyone."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Pinned sample and network boundary",
          "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies."
        }
      ],
      "limits": [
        "No framework package, Figma/plugin workflow, complete SVG corpus, screen-reader, contrast or forced-colors evaluation.",
        "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification."
      ]
    },
    "practicalCaveats": [
      "Choose a default weight, then document why a stronger weight appears in a particular state.",
      "Keep the selected SVGs and their license version together so visual changes remain reviewable."
    ],
    "limits": [
      "Only three raw Check Circle assets from core 2.1.1; the catalog data module was not executed.",
      "No framework package, Figma/plugin workflow, complete SVG corpus, screen-reader, contrast or forced-colors evaluation."
    ],
    "sources": [
      {
        "label": "Core assets and catalog documentation",
        "url": "https://github.com/phosphor-icons/core"
      },
      {
        "label": "Core license",
        "url": "https://github.com/phosphor-icons/core/blob/main/LICENSE"
      },
      {
        "label": "Phosphor homepage source",
        "url": "https://github.com/phosphor-icons/homepage"
      },
      {
        "label": "Dated repository snapshot source",
        "url": "https://github.com/phosphor-icons/homepage"
      },
      {
        "label": "Exact evaluated package archive",
        "url": "https://registry.npmjs.org/@phosphor-icons/core/-/core-2.1.1.tgz"
      }
    ]
  }
}