registry / @central-icons-solid/round-outlined-radius-3-stroke-1.5 / 1.1.319

@central-icons-solid/round-outlined-radius-3-stroke-1.5@1.1.319

A collection of round outlined Solid icons with 3px radius and 1.5px stroke width, designed for use in Solid applications.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The preinstall hook exports a credential-like environment value during dependency installation. Its error handling means a failed or invalid remote check does not reliably stop installation.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package with npm, pnpm, or yarn while CENTRAL_LICENSE_KEY is set.

Impact

An installer-provided license key is disclosed to the remote endpoint without an interactive runtime action.

Mechanism

Preinstall environment-secret exfiltration through an HTTP Authorization header.

Attack narrative

Package installation invokes license-check.js. The script requires CENTRAL_LICENSE_KEY, then posts it as a Bearer token to centralicons.com. It catches remote validation failures and only logs them, so the automatic network disclosure is the reliable effect rather than a dependable license gate.

AI rationale

This icon package performs automatic preinstall credential disclosure. The hook transparently targets one named variable, but automatic export of an environment secret to a remote service is concrete credential-exfiltration behavior.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

@central-icons-solid/round-outlined-radius-3-stroke-1.5@1.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code