@central-icons-solid/square-outlined-radius-0-stroke-2@1.2.13
A collection of square outlined Solid icons with 0px radius and 2px stroke width, designed for use in Solid applications.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe install-time network request is a license check to the package publisher's matching service. The inspected entrypoints export local icon modules and declarations, with no confirmed malicious behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package runs its preinstall hook.
Impact
The check can reject an invalid license; no attack impact was identified.
Mechanism
The check sends the Central Icons license key to the Central Icons license endpoint and validates the response.
AI rationale
The install-time network request is a license check to the package publisher's matching service. The inspected entrypoints export local icon modules and declarations, with no confirmed malicious behavior.
Evidence
package.jsonlicense-check.js
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs license-check.js from the preinstall hook.
- license-check.js reads the Central Icons license key and stops if it is missing.
- license-check.js sends the key to centralicons.com for this package's license check.
- index.jsx exports local icon modules, and index.d.ts provides their matching declarations.
- license-check.js uses the response to validate the license.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg12"files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],
"scripts": {
"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "np
Low
Suspicious Lifecycle Evidence
package.json runs license-check.js from the preinstall hook.
package.jsonView on unpkg · L12license-check.jsView file
•matchType = malicious_source_fingerprint_signature
signature = fd278436d357a415
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320
matchedPath = license-check.js
matchedIdentity = npm:[redacted]:1.1.320
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
2 High2 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
LowAi Review Evidenceindex.jsx
Affected versions and remediation
This report applies to @central-icons-solid/square-outlined-radius-0-stroke-2@1.2.13.
See all versions of @central-icons-solid/square-outlined-radius-0-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-solid/square-outlined-radius-0-stroke-2@1.2.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.