registry / @central-icons-solid/square-outlined-radius-0-stroke-1 / 1.1.318

@central-icons-solid/square-outlined-radius-0-stroke-1@1.1.318

A collection of square outlined Solid icons with 0px radius and 1px stroke width, designed for use in Solid applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

npm installation runs code that transmits an environment-supplied credential. The request includes the license key in an Authorization header.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation

Impact

A license credential in the install environment is disclosed to the remote endpoint.

Mechanism

preinstall credential transmission

Attack narrative

When npm installs the package, its preinstall hook executes license-check.js. That script reads CENTRAL_LICENSE_KEY and makes a POST request to centralicons.com with the value as a Bearer authorization credential. This occurs before the package is available for use and without a user command specifically authorizing credential transmission.

Rationale

The package performs automatic install-time transmission of an environment credential to a network endpoint. This is a concrete credential-exfiltration surface in an icon package.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with false-positive risk.

@central-icons-solid/square-outlined-radius-0-stroke-1@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code