registry / @central-icons-solid/round-filled-radius-3-stroke-1 / 1.1.318

@central-icons-solid/round-filled-radius-3-stroke-1@1.1.318

A collection of round filled Solid icons with 3px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package executes a networked license check. It transmits an environment credential automatically.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

The license key can be disclosed to the remote endpoint without an explicit user command.

Mechanism

Preinstall-time Bearer credential transmission.

Attack narrative

During npm installation, the preinstall script invokes license-check.js. The script reads CENTRAL_LICENSE_KEY from the install environment and POSTs it as an Authorization Bearer value to centralicons.com. This creates an automatic credential-exfiltration path for a package whose declared purpose is an icon library.

AI rationale

The package performs automatic install-time transmission of an environment credential to a remote service. This concrete credential exposure is unrelated to rendering icon components and warrants blocking.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence with false-positive risk.

@central-icons-solid/round-filled-radius-3-stroke-1@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code