registry / @central-icons-solid/round-outlined-radius-2-stroke-1 / 1.1.319

@central-icons-solid/round-outlined-radius-2-stroke-1@1.1.319

A collection of round outlined Solid icons with 2px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically transmits an environment-held license key to centralicons.com. The script suppresses validation failures after sending the token.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

A license key available in the install environment is disclosed to the remote endpoint without an enforced validation outcome.

Mechanism

Preinstall credential transmission over an HTTP Bearer authorization header.

Attack narrative

During npm installation, package.json launches license-check.js. The script reads CENTRAL_LICENSE_KEY and posts it as a Bearer token to centralicons.com. Although it parses invalid-license responses, its catch block only logs errors, allowing installation to continue after the token has been sent. This makes the automatic lifecycle hook a credential-collection path rather than an effective installation gate.

AI rationale

The automatic preinstall hook exports an environment credential to a remote service while swallowing invalid-license failures. This is concrete credential exfiltration at install time.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

An automatic preinstall hook runs the license-check script.
The script sends the CENTRAL_LICENSE_KEY environment value as a Bearer token to a remote host.
Invalid-license errors are caught and only logged, so the network request does not enforce installation.

Evidence against

The inspected runtime icon sources are static Solid SVG components.
No child-process execution, file writes, or dynamic payload loading was found in the inspected executable files.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 2,111 file(s), 4.25 MB of source, external domains: centralicons.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-23json

2 "name": "@central-icons-solid/round-outlined-radius-2-stroke-1",

3 "version": "1.1.319",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "types": "./index.d.ts",

8 "exports": {

9 ".": { "solid": "./index.jsx", "types": "./index.d.ts", "default": "./index.jsx" },

10 "./*": { "solid": "./*/index.tsx", "types": "./*/index.d.ts", "default": "./*/index.tsx" }

11 },

12 "files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],

13 "scripts": {

14 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "build": "node ./build.mjs",

16 "prepublishOnly": "npm run build",

High

Suspicious Lifecycle Evidence

An automatic preinstall hook runs the license-check script.

package.jsonView on unpkg · L13

17 "lint": "node ./build.mjs"

18 },

19 "peerDependencies": { "solid-js": ">=1.6" },

20 "keywords": ["solid", "solid-js", "icons", "svg", "central-icons", "icon-pack"],

21 "author": "Iconists"

22}

license-check.jsView file

Lines 1-47javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build",

High

Suspicious Lifecycle Evidence

An automatic preinstall hook runs the license-check script.

package.jsonView on unpkg · L13

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/square-filled-radius-0-stroke-1.5@1.1.319 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.319 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment",

High

Ai Review Evidence

The script sends the CENTRAL_LICENSE_KEY environment value as a Bearer token to a remote host.

license-check.jsView on unpkg · L1

14const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, }, body: JSON.stringify({ package: "central-icons-solid/round-outlined-radius-2-stroke-1", version: "1.1.319", }),

High

Ai Review Evidence

The script sends the CENTRAL_LICENSE_KEY environment value as a Bearer token to a remote host.

license-check.jsView on unpkg · L14

33const responseJson = await response.json(); if (responseJson.error) { throw new Error(responseJson.error); } if (!responseJson.data.isValid) { throw new Error("Invalid license key"); } } catch (error) { console.error(error); }

High

Ai Review Evidence

Invalid-license errors are caught and only logged, so the network request does not enforce installation.

license-check.jsView on unpkg · L33

Findings

6 High2 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturelicense-check.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencelicense-check.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @central-icons-solid/round-outlined-radius-2-stroke-1@1.1.319.

See version security history for other recorded verdicts.

Avoid installing @central-icons-solid/round-outlined-radius-2-stroke-1@1.1.319. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 16:41:47.711Z (UTC).