registry / @central-icons-qwik/round-filled-radius-0-stroke-1.5 / 1.1.320

@central-icons-qwik/round-filled-radius-0-stroke-1.5@1.1.320

A collection of round filled Qwik icons with 0px radius and 1.5px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Installing the package automatically transmits an environment-held license credential to a remote host. The network action occurs before the package can be used.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or another npm installation that runs preinstall

Impact

A license credential is disclosed to centralicons.com during dependency installation.

Mechanism

preinstall reads an environment credential and posts it as a Bearer token

Attack narrative

The package declares a preinstall hook that runs license-check.js. That script reads CENTRAL_LICENSE_KEY from the installation environment and posts it in an Authorization Bearer header to centralicons.com. This credential transmission is automatic at dependency-install time rather than a separately invoked user command.

AI rationale

Automatic installation-time transmission of an environment credential is concrete credential-exfiltration behavior. The package contains no evidence that the installer independently consents to sending that value to the remote endpoint.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

@central-icons-qwik/round-filled-radius-0-stroke-1.5@1.1.320

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code