registry / @central-icons-qwik/round-outlined-radius-2-stroke-1 / 1.1.319

@central-icons-qwik/round-outlined-radius-2-stroke-1@1.1.319

A collection of round outlined Qwik icons with 2px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically extracts a license-key environment variable and transmits it to a remote service. This is credential disclosure during installation.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A locally configured CENTRAL_LICENSE_KEY is disclosed to centralicons.com without an explicit user command.

Mechanism

Preinstall-time environment credential collection and HTTP POST exfiltration.

Attack narrative

On installation, npm executes license-check.js through the preinstall hook. The script reads CENTRAL_LICENSE_KEY from the environment and posts it as a Bearer authorization value to centralicons.com. This discloses a credential automatically as a condition of installing an icon package.

AI rationale

The package performs unconsented install-time credential transmission. Its icon exports do not require this behavior, so the lifecycle hook forms a concrete credential-exfiltration attack surface.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

with false-positive risk.

@central-icons-qwik/round-outlined-radius-2-stroke-1@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code