registry / @central-icons-solid/round-filled-radius-3-stroke-2 / 1.1.318

@central-icons-solid/round-filled-radius-3-stroke-2@1.1.318

A collection of round filled Solid icons with 3px radius and 2px stroke width, designed for use in Solid applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installation automatically transmits an environment credential to a remote endpoint. The check does not block installation on an invalid response.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation while CENTRAL_LICENSE_KEY is set

Impact

The license credential is disclosed to centralicons.com without an interactive install-time prompt.

Mechanism

preinstall Bearer-token transmission

Attack narrative

When npm installs the package, its preinstall hook runs license-check.js. The script reads CENTRAL_LICENSE_KEY and POSTs it in an Authorization Bearer header to centralicons.com. Errors and invalid-license responses are caught and logged, so the request functions as credential transmission rather than effective installation enforcement.

AI rationale

The package performs an automatic install-time disclosure of an environment credential to the network, while its stated validation outcome is non-enforcing. This is concrete credential-exfiltration behavior despite the otherwise ordinary icon sources.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

with false-positive risk.

@central-icons-solid/round-filled-radius-3-stroke-2@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code