registry / @central-icons-qwik/round-filled-radius-2-stroke-1.5 / 1.1.319

@central-icons-qwik/round-filled-radius-2-stroke-1.5@1.1.319

A collection of round filled Qwik icons with 2px radius and 1.5px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

npm installation invokes a script that transmits an environment-provided license key. This exposes a credential to a remote service before the package is usable.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or any install that runs preinstall.

Impact

The CENTRAL_LICENSE_KEY is disclosed to centralicons.com during dependency installation.

Mechanism

Preinstall environment credential collection and HTTPS POST.

Attack narrative

When the package is installed, npm runs license-check.js automatically. The script requires CENTRAL_LICENSE_KEY, then submits it as an Authorization Bearer token to a remote endpoint. This is credential transmission from an install hook in an icon package, with no user-invoked setup action required.

AI rationale

The package has a concrete automatic install-time credential exfiltration path. The otherwise static icon exports do not mitigate the preinstall behavior.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as with false-positive risk.

@central-icons-qwik/round-filled-radius-2-stroke-1.5@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code