registry / @central-icons-solid/round-filled-radius-3-stroke-1.5 / 1.2.1

@central-icons-solid/round-filled-radius-3-stroke-1.5@1.2.1

A collection of round filled Solid icons with 3px radius and 1.5px stroke width, designed for use in Solid applications.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No attack surface was identified. The only install-time code sends the caller-supplied Central Icons license key to the vendor license endpoint and does not harvest other secrets, write files, or execute remote payloads.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall runs node ./license-check.js when CENTRAL_LICENSE_KEY is present.

Impact

The license key is disclosed only to the vendor that issued it. No consumer project mutation, credential theft, or remote code execution was found.

Mechanism

The script POSTs the license key to the hardcoded vendor URL https://centralicons.com/license/check and otherwise renders static SVG icons on import.

AI rationale

This is a Solid icon package whose only install behavior is a vendor license check that sends CENTRAL_LICENSE_KEY to centralicons.com. No other execution, exfiltration, or agent-control mutation is present in the inspected source.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json is a Solid icon pack with peerDependency solid-js and a single install hook, preinstall, that runs node ./license-check.js.
license-check.js reads CENTRAL_LICENSE_KEY and throws if it is unset, otherwise POSTs it as a Bearer token only to https://centralicons.com/license/check with this package name and version.

@central-icons-solid/round-filled-radius-3-stroke-1.5@1.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code