registry / @central-icons-solid/square-outlined-radius-0-stroke-2 / 1.1.318

@central-icons-solid/square-outlined-radius-0-stroke-2@1.1.318

A collection of square outlined Solid icons with 0px radius and 2px stroke width, designed for use in Solid applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The preinstall hook transmits an environment-held license credential during npm installation. This is automatic credential exfiltration from the installing environment.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

An external service receives the installer’s CENTRAL_LICENSE_KEY.

Mechanism

Reads an environment credential and posts it as a Bearer token.

Attack narrative

On installation, npm runs license-check.js through the preinstall hook. The script reads CENTRAL_LICENSE_KEY from the environment and sends it in an Authorization Bearer header to centralicons.com. This exports a credential automatically during dependency installation rather than through an explicit user command.

Rationale

The package has a concrete automatic install-time credential-transmission path. Static icon exports do not mitigate that lifecycle behavior.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with false-positive risk.

@central-icons-solid/square-outlined-radius-0-stroke-2@1.1.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code