registry / @central-icons-qwik/round-filled-radius-3-stroke-1 / 1.1.320

@central-icons-qwik/round-filled-radius-3-stroke-1@1.1.320

A collection of round filled Qwik icons with 3px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Installing the package runs a script that transmits an environment-held license credential to a remote endpoint. This is automatic install-time credential exfiltration.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, via the preinstall lifecycle hook.

Impact

Exposes CENTRAL_LICENSE_KEY to the endpoint during installation.

Mechanism

Reads an environment variable and posts it as Bearer authorization.

Attack narrative

During installation, npm runs license-check.js before the package is usable. The script obtains CENTRAL_LICENSE_KEY from the installer environment and sends it in an Authorization header to centralicons.com. The request is not initiated by an explicit user command at install time, and request failures are caught after logging, so the install can continue. The package otherwise contains static icon exports, but that does not remove the install-time credential disclosure.

AI rationale

The package has an automatic preinstall hook that sends an environment credential to a remote host. This is concrete credential exfiltration during installation, despite the absence of other payload behavior.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

@central-icons-qwik/round-filled-radius-3-stroke-1@1.1.320

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code