The GitHub account links to this site:
Which looks like a typical sales page. But it also says "free" everywhere. No info on pricing or business model.
The icons page tays to install the icons like this:
npm install tabler-icons --save
- paid support
- paid premium components
- etc
I also see they are already selling email tenplates here: https://gumroad.com/l/tabler-email?utm_source=demo
I'm also very actively looking for a catch whenever I see something like this but this seems entirely benign as far as I can see.
Edit: there's also a pay-what-you-want page when you click download. Still totally ok with me.
The command is a standard way to install a module and save that specific version in package.json. By default I believe it's "^x.x.x", which allows patch versions that increment the last number when explicitly updating - otherwise re/install will always get that specific version.
It's no less (or more) secure than any other dependency. The last vulnerability that I heard about was the ability for modules for run arbitrary commands, for example from the pre/post-install step. If I recall correctly, they added an optional way to disable this, but many modules make use of it for compiling native code, etc.
So - I'd say yes, installing any dependency will make you vulnerable to code coming downstream. However, an SVG icon library with little to no executable code can probably be considered low risk.
can probably be considered low risk
Aside from pre/postinstall scripts, I imagine the SVG and/or CSS files gets copied into a folder of static assets.
Depending on how that's done - manual import or part of a build step; specifying file extensions or not; how assets are served, etc. - that could be "vulnerable to code coming downstream".