registry / @central-icons-qwik/round-filled-radius-1-stroke-1 / 1.1.319

@central-icons-qwik/round-filled-radius-1-stroke-1@1.1.319

A collection of round filled Qwik icons with 1px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installation automatically transmits an environment-held credential to a remote endpoint. No consumer-project files are modified.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

The installer’s CENTRAL_LICENSE_KEY is disclosed to centralicons.com.

Mechanism

Preinstall environment credential collection and remote Bearer-token POST.

Attack narrative

When npm installs the package, preinstall starts license-check.js. The script reads CENTRAL_LICENSE_KEY from the environment and posts it as an Authorization Bearer value to centralicons.com. This is automatic credential egress during dependency installation; the package does not need to be imported.

AI rationale

The package performs automatic install-time transmission of an environment credential. Static inspection found no other execution or mutation behavior, but this concrete credential-exfiltration path warrants blocking.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

The npm preinstall hook automatically runs license-check.js.
The hook reads CENTRAL_LICENSE_KEY from the installer environment.
It sends that value as a Bearer credential to a remote host during installation.
The script invokes the network check immediately when loaded.

Evidence against

No file-system writes, child-process execution, dynamic code loading, or additional network endpoints were found.
The remaining runtime modules are Qwik SVG icon exports.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 2,109 file(s), 4.33 MB of source, external domains: centralicons.com, www.w3.org

Oversized source lightweight scan

icons/index.mjs2.22 MB file, sampled 256 KB

HighEntropyStringsMinified

Source & flagged code

4 flagged

package.jsonView file

Lines 1-26json

2 "name": "@central-icons-qwik/round-filled-radius-1-stroke-1",

3 "version": "1.1.319",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "type": "module",

8 "module": "./index.mjs",

9 "types": "./index.d.ts",

10 "exports": {

11 ".": { "types": "./index.d.ts", "import": "./index.mjs" },

12 "./*": { "types": "./*/index.d.ts", "import": "./*/index.mjs" }

13 },

14 "files": ["**/*.mjs", "**/*.map", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],

15 "scripts": {

16 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

17 "build": "bun build.ts",

18 "prepublishOnly": "npm run build",

19 "lint": "biome format --write ."

20 },

High

Suspicious Lifecycle Evidence

The npm preinstall hook automatically runs license-check.js.

package.jsonView on unpkg · L15

21 "peerDependencies": { "@builder.io/qwik": ">=1.5" },

22 "devDependencies": { "@types/node": "^24", "@builder.io/qwik": "^1", "@biomejs/biome": "^2", "typescript": "^5" },

23 "keywords": ["qwik", "icons", "svg", "central-icons", "icon-pack"],

24 "author": "Iconists"

25}

license-check.jsView file

Lines 1-21javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

High

Ai Review Evidence

The hook reads CENTRAL_LICENSE_KEY from the installer environment.

license-check.jsView on unpkg · L1

3if (!licenseKey) {

4 throw new Error

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"scripts": { "preinstall": "node ./license-check.js", "build": "bun build.ts", "prepublishOnly": "npm run build", "lint": "biome format --write ." }

High

Suspicious Lifecycle Evidence

The npm preinstall hook automatically runs license-check.js.

package.jsonView on unpkg · L15

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = 1f08d895a69ab021 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-qwik/round-filled-radius-2-stroke-1.5@1.1.319 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.319 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

High

Ai Review Evidence

The hook reads CENTRAL_LICENSE_KEY from the installer environment.

license-check.jsView on unpkg · L1

Findings

4 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturelicense-check.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencelicense-check.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @central-icons-qwik/round-filled-radius-1-stroke-1@1.1.319.

See version security history for other recorded verdicts.

Avoid installing @central-icons-qwik/round-filled-radius-1-stroke-1@1.1.319. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 16:49:02.033Z (UTC).