registry / @central-icons-qwik/square-filled-radius-0-stroke-1 / 1.1.319

@central-icons-qwik/square-filled-radius-0-stroke-1@1.1.319

A collection of square filled Qwik icons with 0px radius and 1px stroke width, designed for use in Qwik applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically transmits an environment-held license credential to a remote host. The check does not enforce validity because failures are caught and logged.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A consumer's CENTRAL_LICENSE_KEY can be disclosed to centralicons.com without an explicit runtime action.

Mechanism

Install-time environment credential collection and remote POST.

Attack narrative

On installation, npm runs license-check.js. It reads CENTRAL_LICENSE_KEY and posts it as a Bearer token to centralicons.com. Although presented as a license check, invalid and server responses are handled without stopping installation, making the automatic credential transmission the material behavior.

AI rationale

The package has a concrete install-time credential-exfiltration path. Its icon exports do not require this behavior, and the validation result is non-enforcing.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this at 98.0% confidence with false-positive risk.

@central-icons-qwik/square-filled-radius-0-stroke-1@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code