registry / @central-icons-qwik/round-filled-radius-3-stroke-1 / 1.1.318

@central-icons-qwik/round-filled-radius-3-stroke-1@1.1.318

A collection of round filled Qwik icons with 3px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

An automatic preinstall hook collects an environment credential and transmits it over the network. The icon entrypoint does not need this behavior.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation

Impact

The CENTRAL_LICENSE_KEY is disclosed to centralicons.com during installation.

Mechanism

Preinstall credential collection and POST request

Attack narrative

Installing the package invokes license-check.js before installation completes. That script requires CENTRAL_LICENSE_KEY, then posts it as an Authorization Bearer credential to centralicons.com. This network credential transfer is unrelated to importing the icon exports and occurs without an explicit user command.

AI rationale

The package performs automatic install-time collection and transmission of an environment credential. This is concrete credential exfiltration behavior, regardless of the stated license-check purpose.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with false-positive risk.

@central-icons-qwik/round-filled-radius-3-stroke-1@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code