registry / @central-icons-solid/round-outlined-radius-1-stroke-1 / 1.1.317

@central-icons-solid/round-outlined-radius-1-stroke-1@1.1.317

A collection of round outlined Solid icons with 1px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically transmits the environment license key to a remote license endpoint. No broader host modification or payload execution was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

The license credential is disclosed to centralicons.com without an interactive installation-time prompt.

Mechanism

Install-time transmission of an environment credential in an HTTP Authorization header.

AI rationale

This is a real install-time credential disclosure, although the endpoint and data format are consistent with license validation and no additional malicious behavior was found. It warrants a warning rather than a publication block.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The automatic preinstall hook runs license-check.js.
That script reads CENTRAL_LICENSE_KEY and sends it as a Bearer token to centralicons.com during installation.

@central-icons-solid/round-outlined-radius-1-stroke-1@1.1.317

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code