registry / @central-icons-qwik/round-outlined-radius-3-stroke-1 / 1.1.319

@central-icons-qwik/round-outlined-radius-3-stroke-1@1.1.319

A collection of round outlined Qwik icons with 3px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installation automatically exports an environment-held license credential over the network. No user command is required beyond installing the package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

The CENTRAL_LICENSE_KEY is disclosed to centralicons.com whenever present in the installation environment.

Mechanism

Preinstall environment credential exfiltration by HTTP POST

Attack narrative

npm invokes the preinstall hook, which runs license-check.js. The script reads CENTRAL_LICENSE_KEY from the process environment and POSTs it in an Authorization Bearer header to centralicons.com. This occurs before the package can be used and without an explicit user command for credential submission.

AI rationale

This package automatically transmits an environment credential during preinstall. The source establishes a concrete credential-exfiltration path, so it should be blocked.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

@central-icons-qwik/round-outlined-radius-3-stroke-1@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code