registry / @central-icons-qwik/round-filled-radius-1-stroke-1 / 1.1.317

@central-icons-qwik/round-filled-radius-1-stroke-1@1.1.317

A collection of round filled Qwik icons with 1px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically runs a remote license check. The check transmits an environment-supplied license key to the vendor endpoint.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A license key present in the installer environment is disclosed to the configured remote service.

Mechanism

Preinstall-time environment credential transmission over HTTPS.

AI rationale

This is a concrete install-time credential transmission, though inspection found no shell execution, persistence, project mutation, or payload loading. Treat it as an unresolved supply-chain privacy risk rather than confirmed malware.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

An automatic preinstall hook executes license-check.js.
The hook reads CENTRAL_LICENSE_KEY from the install environment.

@central-icons-qwik/round-filled-radius-1-stroke-1@1.1.317

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code