registry / @central-icons-qwik/round-outlined-radius-1-stroke-1 / 1.1.301

@central-icons-qwik/round-outlined-radius-1-stroke-1@1.1.301

A collection of round outlined Qwik icons with 1px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

npm installation executes a license check that transmits a local environment secret. No runtime attack behavior was confirmed in the icon exports.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

A configured CENTRAL_LICENSE_KEY is sent automatically to a remote service.

Mechanism

preinstall license-key transmission

AI rationale

The package is an icon library, but its install hook performs an automatic remote credential check. Source inspection found no additional malicious chain, so this warrants a warning rather than a block.

Evidence

package.jsonlicense-check.jsindex.mjsIconAgenticCoding/index.mjs

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs license-check.js in preinstall.
license-check.js reads CENTRAL_LICENSE_KEY and POSTs it as Bearer auth.

@central-icons-qwik/round-outlined-radius-1-stroke-1@1.1.301

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code