registry / @central-icons-solid/round-outlined-radius-0-stroke-1 / 1.1.318

@central-icons-solid/round-outlined-radius-0-stroke-1@1.1.318

A collection of round outlined Solid icons with 0px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installation automatically transmits an environment credential to a remote host. This is unrelated to rendering the package's icon exports.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A credential present in the install environment is disclosed to centralicons.com.

Mechanism

Reads an environment credential and posts it as Bearer authorization.

Attack narrative

When npm installs the package, its preinstall hook executes license-check.js. The script reads CENTRAL_LICENSE_KEY and posts it as a Bearer credential to a remote endpoint. The package aborts before the request when the variable is absent, so installations in licensed build environments are specifically targeted. The icon source itself does not require this network action.

AI rationale

The package performs automatic install-time transmission of a credential from the consumer environment. The claimed license-check purpose does not remove the concrete credential-exfiltration surface.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

with false-positive risk.

@central-icons-solid/round-outlined-radius-0-stroke-1@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code