registry / @central-icons-solid/round-filled-radius-1-stroke-2 / 1.1.318

@central-icons-solid/round-filled-radius-1-stroke-2@1.1.318

A collection of round filled Solid icons with 1px radius and 2px stroke width, designed for use in Solid applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically reads a license-key environment variable and transmits it to a remote host. This is an install-time credential-exfiltration surface.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation

Impact

A consumer's CENTRAL_LICENSE_KEY is disclosed to centralicons.com without an explicit runtime command.

Mechanism

preinstall reads an environment credential and POSTs it as Bearer authorization

Attack narrative

On npm installation, package.json invokes license-check.js. The script reads CENTRAL_LICENSE_KEY and sends it in an Authorization Bearer header to centralicons.com. The request is automatic, and request failures are caught and logged rather than preventing installation. This creates a concrete install-time path for transmitting a credential from the consumer environment.

AI rationale

The package automatically exfiltrates an environment credential during preinstall. The absence of destructive behavior does not remove this concrete credential-disclosure risk.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

with false-positive risk.

@central-icons-solid/round-filled-radius-1-stroke-2@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code