registry / @central-icons-solid/round-filled-radius-1-stroke-1 / 1.1.318

@central-icons-solid/round-filled-radius-1-stroke-1@1.1.318

A collection of round filled Solid icons with 1px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installation automatically transmits the supplied Central license key to the vendor license endpoint. No other harmful behavior is established from the inspected source.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall lifecycle hook when CENTRAL_LICENSE_KEY is set.

Impact

The license credential is disclosed to centralicons.com; this is an automatic network action at install time.

Mechanism

License-key transmission in an install-time HTTP POST.

AI rationale

The package performs a real automatic credential-bearing network action during preinstall, so it should be warned on. The inspected code does not establish broader malicious behavior or an AI-agent control-surface attack.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The preinstall hook automatically runs license-check.js.

@central-icons-solid/round-filled-radius-1-stroke-1@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code