Loading npm security reports…

@central-icons-solid/round-outlined-radius-2-stroke-1@1.2.1 | LPM Firewall

registry / @central-icons-solid/round-outlined-radius-2-stroke-1 / 1.2.1

@central-icons-solid/round-outlined-radius-2-stroke-1@1.2.1

A collection of round outlined Solid icons with 2px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No attack surface was established. The preinstall script is a vendor license check that sends only the installer-supplied Central Icons key to centralicons.com, and icon modules do not execute network, shell, or file-harvesting code.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm preinstall runs license-check.js when CENTRAL_LICENSE_KEY is present.

Impact

Install may fail if the license variable is missing. No secret theft, remote code execution, persistence, or agent-config mutation was found.

Mechanism

The script posts the supplied license key to the vendor license endpoint and otherwise exports Solid icon components.

AI rationale

The preinstall hook only validates a user-provided Central Icons license against the vendor license host, which matches this commercial icon package. No harvesting, payload execution, self-install chain, or unconsented agent control-surface write is present.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The only install hook is preinstall running node ./license-check.js; there is no postinstall and no runtime dependency on this package name.
license-check.js reads CENTRAL_LICENSE_KEY and throws if that variable is unset, so the gate uses a key the installer supplies for this product.

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "preinstall": "node ./license-check.js", "build": "node ./build.mjs", "prepublishOnly": "npm run build", "lint": "node ./build.mj

Low

Suspicious Lifecycle Evidence

The only install hook is preinstall running node ./license-check.js; there is no postinstall and no runtime dependency on this package name.

package.jsonView on unpkg · L13

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.320 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

1const licenseKey = process.env.CENTRAL_LICENSE_KEY; if (!licenseKey) { throw new Error( "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environ

Low

Ai Review Evidence

license-check.js reads CENTRAL_LICENSE_KEY and throws if that variable is unset, so the gate uses a key the installer supplies for this product.

license-check.jsView on unpkg · L1

14const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, }, body: JSON.stringify({

Low

Ai Review Evidence

The script POSTs that key as a Bearer token only to https://centralicons.com/license/check with this package name and version 1.2.1.

license-check.jsView on unpkg · L14

28if (controller.signal.aborted || response.status >= 500) { // Server Error, handling in customer favour return; } const responseJson = await response.json(); if (response

Low

Ai Review Evidence

Server errors at status 500 or higher return without failing the install, and later validation errors are only logged. The rest of the package is Solid SVG icon components plus an optional skill document the user must install separately.

license-check.jsView on unpkg · L28