registry / @central-icons-solid/round-outlined-radius-1-stroke-2 / 1.1.319

@central-icons-solid/round-outlined-radius-1-stroke-2@1.1.319

A collection of round outlined Solid icons with 1px radius and 2px stroke width, designed for use in Solid applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package triggers a network request that transmits a license credential from the consumer environment. No other confirmed payload or local mutation was found.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

The package vendor receives the consumer's CENTRAL_LICENSE_KEY automatically during installation.

Mechanism

Reads an environment credential and posts it in an Authorization header.

Attack narrative

A dependency installation invokes license-check.js before the package can be used. That script reads CENTRAL_LICENSE_KEY from the install environment and sends it as a Bearer token to centralicons.com. Although framed as license validation, this is automatic credential disclosure by an icon package rather than a user-invoked action.

AI rationale

The package has a concrete install-time credential-exfiltration path. The absence of additional payload behavior does not remove the risk of automatically transmitting an environment secret.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

with false-positive risk.

@central-icons-solid/round-outlined-radius-1-stroke-2@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code