Loading npm security reports…
A collection of round filled Solid icons with 2px radius and 1px stroke width, designed for use in Solid applications.
No attack surface was established. The preinstall license check sends the caller-supplied Central Icons key only to the vendor license endpoint, and the packaged skill is not installed unless the user runs a separate command.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe only install lifecycle hook is preinstall running node ./license-check.js; peerDependencies is solid-js and there is no runtime self-dependency.
package.jsonView on unpkg · L13Source fingerprint signature matches a known malicious package signature; route for source-aware review.
license-check.jsView on unpkglicense-check.js reads CENTRAL_LICENSE_KEY and throws if it is missing, which is the key this icon vendor documents for its own license.
license-check.jsView on unpkg · L1The script POSTs that key as a Bearer token only to https://centralicons.com/license/check with this package name and version 1.2.1, then logs response errors without further execution.
license-check.jsView on unpkg · L14This report applies to @central-icons-solid/round-filled-radius-2-stroke-1@1.2.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L14The only install lifecycle hook is preinstall running node ./license-check.js; peerDependencies is solid-js and there is no runtime self-dependency.
package.jsonView on unpkg · L13license-check.js reads CENTRAL_LICENSE_KEY and throws if it is missing, which is the key this icon vendor documents for its own license.
license-check.jsView on unpkg · L1The script POSTs that key as a Bearer token only to https://centralicons.com/license/check with this package name and version 1.2.1, then logs response errors without further execution.
license-check.jsView on unpkg · L14Source fingerprint signature matches a known malicious package signature; route for source-aware review.
license-check.jsView on unpkg