registry / @central-icons-solid/round-outlined-radius-3-stroke-1.5 / 1.1.318

@central-icons-solid/round-outlined-radius-3-stroke-1.5@1.1.318

A collection of round outlined Solid icons with 3px radius and 1.5px stroke width, designed for use in Solid applications.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package runs code that transmits an environment-provided license key to a remote server. This is automatic credential disclosure during dependency installation.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

A consumer's CENTRAL_LICENSE_KEY is disclosed to centralicons.com without an explicit user command.

Mechanism

Environment license-key collection and authenticated POST request.

Attack narrative

The package declares a preinstall hook, so npm runs license-check.js automatically. The script requires CENTRAL_LICENSE_KEY and submits it as an Authorization Bearer token to centralicons.com. This makes installation of an icon package send a process credential over the network before the package is used.

AI rationale

The automatic lifecycle hook extracts an environment credential and transmits it remotely. Although framed as license validation, it is an unconsented install-time credential-exfiltration surface.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

with false-positive risk.

@central-icons-solid/round-outlined-radius-3-stroke-1.5@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code