registry / @central-icons-qwik/round-outlined-radius-1-stroke-1 / 1.1.319

@central-icons-qwik/round-outlined-radius-1-stroke-1@1.1.319

A collection of round outlined Qwik icons with 1px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically reads a license-key environment variable and transmits it to a remote server. This is secret exfiltration from an install hook.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, through the preinstall lifecycle hook.

Impact

A CENTRAL_LICENSE_KEY present in the install environment is disclosed to centralicons.com.

Mechanism

Reads an environment secret and posts it as Bearer authentication.

Attack narrative

During npm installation, package.json invokes license-check.js. The script obtains CENTRAL_LICENSE_KEY from the environment and posts it in an Authorization Bearer header to centralicons.com. The hook therefore transfers a credential without any explicit user command.

AI rationale

This icon package has an automatic installation hook that exfiltrates an environment credential to a remote endpoint. The behavior is concrete and does not require importing the package.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence with false-positive risk.

@central-icons-qwik/round-outlined-radius-1-stroke-1@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code