@central-icons-solid/square-outlined-radius-0-stroke-1@1.2.10
A collection of square outlined Solid icons with 0px radius and 1px stroke width, designed for use in Solid applications.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe install-time network request is a package-specific license check, and its key is explicitly supplied through the environment for that service. The inspected source does not establish an attack; scanner labels do not outweigh the source behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Package installation runs the preinstall hook, which invokes `license-check.js`.
Impact
The license service receives the supplied key for validation; inspected source does not show unrelated credential collection or other side effects.
Mechanism
The script reads `CENTRAL_LICENSE_KEY` and sends it as a bearer token with the package name and version to `centralicons.com/license/check`.
AI rationale
The install-time network request is a package-specific license check, and its key is explicitly supplied through the environment for that service. The inspected source does not establish an attack; scanner labels do not outweigh the source behavior.
Evidence
package.jsonlicense-check.js
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `package.json` runs `license-check.js` as a preinstall hook.
- `license-check.js` reads the caller-provided `CENTRAL_LICENSE_KEY` and sends it as a bearer token to `centralicons.com/license/check`, with this package name and version in the request.
- The request is activated by the script’s direct `licenseCheck()` call; the inspected source shows no unrelated recipient or additional file mutation.
Evidence against
- Scanner hints flag a source fingerprint and network or environment access; those labels alone do not establish malicious behavior.
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg14"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build
Low
Suspicious Lifecycle Evidence
`package.json` runs `license-check.js` as a preinstall hook.
package.jsonView on unpkg · L14license-check.jsView file
•matchType = malicious_source_fingerprint_signature
signature = fd278436d357a415
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320
matchedPath = license-check.js
matchedIdentity = npm:[redacted]:1.1.320
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
2 High2 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
Affected versions and remediation
This report applies to @central-icons-solid/square-outlined-radius-0-stroke-1@1.2.10.
See all versions of @central-icons-solid/square-outlined-radius-0-stroke-1 for other recorded verdicts.
- Review the evidence and your use of @central-icons-solid/square-outlined-radius-0-stroke-1@1.2.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.