registry / @central-icons-react/all / 1.1.316

@central-icons-react/all@1.1.316

A comprehensive collection of professionally designed React icons featuring customizable styles including round and square shapes, filled and outlined variants, multiple stroke widths, and corner radius options. The collection contains 2089 icons with 30

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Installation automatically transmits an environment-provided license credential. No runtime attack surface was found in the icon entrypoints.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

The installer’s license credential is disclosed to a remote service without an explicit user command; the claimed validation is non-enforcing.

Mechanism

Reads an environment credential and posts it as a bearer token.

Attack narrative

On npm installation, package.json launches license-check.js. That script obtains CENTRAL_LICENSE_KEY from the environment and sends it in an Authorization bearer header to centralicons.com. The request is made automatically rather than through an explicit license-management command. The script catches and merely logs all resulting errors, including invalid license responses, so its observable effect is credential transmission rather than effective installation gating.

AI rationale

This package automatically exfiltrates an environment credential in a preinstall hook, while its stated validation does not enforce a result. The icon runtime code appears benign, but it does not neutralize the install-time credential disclosure.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

@central-icons-react/all@1.1.316

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code