registry / Credential exfiltration / @central-icons-solid/square-outlined-radius-0-stroke-1
@central-icons-solid/square-outlined-radius-0-stroke-1
A collection of square outlined Solid icons with 0px radius and 1px stroke width, designed for use in Solid applications.
This report shows the evidence for @central-icons-solid/square-outlined-radius-0-stroke-1@1.1.318. 1 of 26 known versions is blocked or flagged. The newest version, 1.2.19, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs automatic install-time transmission of an environment credential to a network endpoint. This is a concrete credential-exfiltration surface in an icon package.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation
Impact
A license credential in the install environment is disclosed to the remote endpoint.
Mechanism
preinstall credential transmission
Attack narrative
When npm installs the package, its preinstall hook executes license-check.js. That script reads CENTRAL_LICENSE_KEY and makes a POST request to centralicons.com with the value as a Bearer authorization credential. This occurs before the package is available for use and without a user command specifically authorizing credential transmission.
AI rationale
The package performs automatic install-time transmission of an environment credential to a network endpoint. This is a concrete credential-exfiltration surface in an icon package.
Evidence
package.jsonlicense-check.js
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Installation automatically runs a custom script.
- The install script reads a license key from the environment and sends it as a Bearer credential to a remote host.
Evidence against
- The inspected install script contains no filesystem writes, shell execution, or payload loading.
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg12"files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],
"scripts": {
"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build",
High
license-check.jsView file
•matchType = malicious_source_fingerprint_signature
signature = fd278436d357a415
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1@1.1.317
matchedPath = license-check.js
matchedIdentity = npm:[redacted]:1.1.317
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
5 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturelicense-check.js
HighAi Review Evidencepackage.json
HighAi Review Evidencelicense-check.js
HighAi Review Evidencelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @central-icons-solid/square-outlined-radius-0-stroke-1@1.1.318.
The versions list below shows the verdict for each recorded version.
- Avoid installing @central-icons-solid/square-outlined-radius-0-stroke-1@1.1.318. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.