@central-icons-solid/round-outlined-radius-3-stroke-1.5@1.2.1 | LPM Firewall

Loading npm security reports…

@central-icons-solid/round-outlined-radius-3-stroke-1.5@1.2.1 | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

14"preinstall": "node ./license-check.js", "build

Medium

Suspicious Lifecycle Evidence

Installation runs a license-check script through a preinstall hook.

package.jsonView on unpkg · L14

license-check.jsView file

•matchType = malicious_source_fingerprint_signature signature = fd278436d357a415 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320 matchedPath = license-check.js matchedIdentity = npm:[redacted]:1.1.320 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

license-check.jsView on unpkg

13try { const response = await fetch("https://centralicons.com/license/check", { method: "POST", headers: { Authorization: `Bearer ${licenseKey}`, }, body: JSON.stringify({ package: "central-icons-solid/round-outlined-radius-3-stroke-1.5", version: "1.2.1", }),

Medium

Ai Review Evidence

The check sends the supplied license key to the Central Icons license endpoint with this package identity.

license-check.jsView on unpkg · L13

README.mdView file

2411## AI Assistant Support This package ships a skill for AI coding assistants (Claude Code, Cursor, GitHub Copilot, and 40+ others) that teaches the assistant how to find icons by name, alias, or category and insert them with correct imports. After installing the package, add the skill with the [Vercel `skills` CLI](https://github.com/vercel-labs/skills): ```bash npx skills add ./node_modules/@central-icons-solid/round-outlined-radius-3-stroke-1.5 ``` The CLI auto-detects which AI assistant you use and installs t

Medium

Ai Review Evidence

The package directs users to run a command that installs its AI-assistant skill.

README.mdView on unpkg · L2411

skills/central-icons-solid/SKILL.mdView file

1--- name: central-icons-solid description: Use when inserting icons in Solid code that imports from @central-icons-solid/* — provides icon lookup by name, alias, or category and variant-aware import guidance. --- # Central Icons — Solid This skill helps you find icons from the Central Icons So

Medium

Ai Review Evidence

The bundled skill contains icon lookup and import guidance.

skills/central-icons-solid/SKILL.mdView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

Lines 1-23json

1{

2 "name": "@central-icons-solid/round-outlined-radius-3-stroke-1.5",

3 "version": "1.2.1",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "types": "./index.d.ts",

8 "exports": {

9 ".": { "solid": "./index.jsx", "types": "./index.d.ts", "default": "./index.jsx" },

10 "./*": { "solid": "./*/index.tsx", "types": "./*/index.d.ts", "default": "./*/index.tsx" }

11 },

12 "files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],

13 "scripts": {

14 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "build": "node ./build.mjs",

Medium

Suspicious Lifecycle Evidence

Installation runs a license-check script through a preinstall hook.

package.jsonView on unpkg · L14

16 "prepublishOnly": "npm run build",

17 "lint": "node ./build.mjs"

18 },

19 "peerDependencies": { "solid-js": ">=1.6" },

20 "keywords": ["solid", "solid-js", "icons", "svg", "central-icons", "icon-pack"],

21 "author": "Iconists"

22}

23

license-check.jsView file

Lines 1-33javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

2

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment",

README.mdView file

Lines 2391-2431markdown

2391- IconSnowFlakes

2392- IconWind

2393- IconCloudWeather

2394- IconCloudy

2395- IconCloudySun

2396- IconRainy

2397- IconRainyLight

2398- IconCloudSnow

skills/central-icons-solid/SKILL.mdView file

Lines 1-21markdown

1---

2name: central-icons-solid

3description: Use when inserting icons in Solid code that imports from @central-icons-solid/* — provides icon lookup by name, alias, or category and variant-aware import guidance.

4---

5

6# Central Icons — Solid

7

8This skill helps you find icons from the Central Icons Solid library (`@central-icons-solid/*`, version 1.2.1) and insert them with the correct import path for whichever variant the consumer has installed. The set of 2112 icons is consistent across variants; only the stylistic rendering (round vs square, filled vs outlined, corner radius, stroke width) differs.