@central-icons-solid/square-outlined-radius-0-stroke-1@1.2.8
A collection of square outlined Solid icons with 0px radius and 1px stroke width, designed for use in Solid applications.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe lifecycle network activity is an explicit license check against the package vendor's endpoint, using its license key and package identity. The inspected source does not establish unrelated credential exposure or malicious behavior, so the scanner signals do not warrant a warning.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Package installation with the preinstall lifecycle hook, when CENTRAL_LICENSE_KEY is set.
Impact
License validation with the vendor; no unrelated credential exposure or other attack behavior is established by the inspected source.
Mechanism
The checker sends the environment-provided key as a bearer credential to the package's license validation service along with the package identity and version.
AI rationale
The lifecycle network activity is an explicit license check against the package vendor's endpoint, using its license key and package identity. The inspected source does not establish unrelated credential exposure or malicious behavior, so the scanner signals do not warrant a warning.
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The preinstall hook runs the package's license checker.
- The checker reads CENTRAL_LICENSE_KEY and sends it as a bearer credential to the package's centralicons.com license endpoint; this is package-aligned license validation.
- The checker posts the package identity and version, then handles the validity response.
Evidence against
- The source shows no unrelated recipient, credential harvesting, or payload execution in the inspected lifecycle checker.
- The checker is not run by the icon entrypoints shown in the manifest.
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg13"scripts": {
"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build",
"lint": "node ./build.mjs"
},
Low
Suspicious Lifecycle Evidence
The preinstall hook runs the package's license checker.
package.jsonView on unpkg · L13license-check.jsView file
•matchType = malicious_source_fingerprint_signature
signature = fd278436d357a415
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320
matchedPath = license-check.js
matchedIdentity = npm:[redacted]:1.1.320
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
2 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
Affected versions and remediation
This report applies to @central-icons-solid/square-outlined-radius-0-stroke-1@1.2.8.
See all versions of @central-icons-solid/square-outlined-radius-0-stroke-1 for other recorded verdicts.
- Review the evidence and your use of @central-icons-solid/square-outlined-radius-0-stroke-1@1.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.