@central-icons-solid/round-filled-radius-3-stroke-1@1.2.1 | LPM Firewall

Loading npm security reports…

@central-icons-solid/round-filled-radius-3-stroke-1@1.2.1 | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

12"files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"], "scripts": { "preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build", "l

Medium

Ai Review Evidence

The manifest runs license-check.js automatically during preinstall.

package.jsonView on unpkg · L12

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.320 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment", ); } const licenseCheck = async () => { const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), 5000); try { const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, },

Medium

Ai Review Evidence

The license check sends the supplied license key only to a fixed license-check endpoint.

license-check.jsView on unpkg · L1

README.mdView file

2411## AI Assistant Support This package ships a skill for AI coding assistants (Claude Code, Cursor, GitHub Copilot, and 40+ others) that teaches the assistant how to find icons by name, alias, or category and insert them with correct imports. After installing the package, add the skill with the [Vercel `skills` CLI](https://github.com/vercel-labs/skills): ```bash npx skills add ./node_modules/@central-icons-solid/round-filled-radius-3-stroke-1 ``` The CLI auto-detects which AI assistant you use and installs the s

Medium

Ai Review Evidence

The package directs users to install its AI assistant skill through an external skills command.

README.mdView on unpkg · L2411

skills/central-icons-solid/SKILL.mdView file

20**Check the consumer's `package.json` for installed variants** — dependencies matching `@central-icons-solid/*` (excluding `@central-icons-solid/all`). - **One variant installed:** use it. - **Multiple variants installed** (e.g. filled + outlined side-by-side for active/inactive states): pick per-file based on (1) existing imports in the file you're editing, (2) the user's explicit request about style, or (3) the first matching entry in `package.json`. - **No variant insta

Medium

Ai Review Evidence

The shipped skill instructs an AI assistant to inspect the consumer package manifest for installed variants.

skills/central-icons-solid/SKILL.mdView on unpkg · L20

Source & flagged code

6 flagged

package.jsonView file

Lines 1-23json

1{

2 "name": "@central-icons-solid/round-filled-radius-3-stroke-1",

3 "version": "1.2.1",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "types": "./index.d.ts",

8 "exports": {

9 ".": { "solid": "./index.jsx", "types": "./index.d.ts", "default": "./index.jsx" },

10 "./*": { "solid": "./*/index.tsx", "types": "./*/index.d.ts", "default": "./*/index.tsx" }

11 },

12 "files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],

13 "scripts": {

14 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "build": "node ./build.mjs",

16 "prepublishOnly": "npm run build",

17 "lint": "node ./build.mjs"

Medium

Ai Review Evidence

The manifest runs license-check.js automatically during preinstall.

package.jsonView on unpkg · L12

18 },

19 "peerDependencies": { "solid-js": ">=1.6" },

20 "keywords": ["solid", "solid-js", "icons", "svg", "central-icons", "icon-pack"],

21 "author": "Iconists"

22}

23

license-check.jsView file

Lines 1-21javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

2

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"

README.mdView file

Lines 2391-2431markdown

2391- IconSnowFlakes

2392- IconWind

2393- IconCloudWeather

2394- IconCloudy

2395- IconCloudySun

2396- IconRainy

2397- IconRainyLight

2398- IconCloudSnow

skills/central-icons-solid/SKILL.mdView file

Lines 1-40markdown

1---

2name: central-icons-solid

3description: Use when inserting icons in Solid code that imports from @central-icons-solid/* — provides icon lookup by name, alias, or category and variant-aware import guidance.

4---

5

6# Central Icons — Solid

7

8This skill helps you find icons from the Central Icons Solid library (`@central-icons-solid/*`, version 1.2.1) and insert them with the correct import path for whichever variant the consumer has installed. The set of 2112 icons is consistent across variants; only the stylistic rendering (round vs square, filled vs outlined, corner radius, stroke width) differs.