registry / @central-icons-solid/round-filled-radius-3-stroke-1.5 / 1.1.319

@central-icons-solid/round-filled-radius-3-stroke-1.5@1.1.319

A collection of round filled Solid icons with 3px radius and 1.5px stroke width, designed for use in Solid applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

A preinstall hook extracts a license key from the installer environment and transmits it over the network. The key is sent automatically before the package installs.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

The installer’s CENTRAL_LICENSE_KEY is disclosed to centralicons.com.

Mechanism

Environment credential collection and outbound Bearer-token POST.

Attack narrative

During npm installation, package.json invokes license-check.js. That script reads CENTRAL_LICENSE_KEY and places its value in an Authorization Bearer header for a POST request to centralicons.com. This automatic lifecycle collection sends a credential before the package is available for use.

AI rationale

The package performs automatic install-time extraction and network transmission of an environment credential. This is a concrete credential-exfiltration surface, regardless of the stated license-check purpose.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Installation automatically runs license-check.js before installation.
The hook reads CENTRAL_LICENSE_KEY from the installer environment.
The hook POSTs that key as a Bearer token to centralicons.com.
The hook suppresses network and validation errors after logging them.

Evidence against

The checked script contains no file writes, shell execution, or downloaded code.
Its request body is limited to a package identifier and version.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 2,110 file(s), 3.27 MB of source, external domains: centralicons.com, www.w3.org

Oversized source lightweight scan

icons/index.jsx2.30 MB file, sampled 256 KB

Minified

Source & flagged code

4 flagged

package.jsonView file

Lines 1-23json

2 "name": "@central-icons-solid/round-filled-radius-3-stroke-1.5",

3 "version": "1.1.319",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "types": "./index.d.ts",

8 "exports": {

9 ".": { "solid": "./index.jsx", "types": "./index.d.ts", "default": "./index.jsx" },

10 "./*": { "solid": "./*/index.tsx", "types": "./*/index.d.ts", "default": "./*/index.tsx" }

11 },

12 "files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],

13 "scripts": {

14 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "build": "node ./build.mjs",

16 "prepublishOnly": "npm run build",

17 "lint": "node ./build.mjs"

18 },

High

Ai Review Evidence

Installation automatically runs license-check.js before installation.

package.jsonView on unpkg · L13

19 "peerDependencies": { "solid-js": ">=1.6" },

20 "keywords": ["solid", "solid-js", "icons", "svg", "central-icons", "icon-pack"],

21 "author": "Iconists"

22}

license-check.jsView file

Lines 1-21javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build", "lint": "node ./build.mjs" }

High

Ai Review Evidence

Installation automatically runs license-check.js before installation.

package.jsonView on unpkg · L13

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-solid/round-outlined-radius-2-stroke-1@1.1.319 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.319 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment", ); }

High

Ai Review Evidence

The hook reads CENTRAL_LICENSE_KEY from the installer environment.

license-check.jsView on unpkg · L1

Findings

4 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturelicense-check.js

HighAi Review Evidencepackage.json

HighAi Review Evidencelicense-check.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @central-icons-solid/round-filled-radius-3-stroke-1.5@1.1.319.

See version security history for other recorded verdicts.

Avoid installing @central-icons-solid/round-filled-radius-3-stroke-1.5@1.1.319. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 16:58:00.683Z (UTC).