@central-icons-solid/square-outlined-radius-0-stroke-2@1.2.15
A collection of square outlined Solid icons with 0px radius and 2px stroke width, designed for use in Solid applications.
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection shows a license check triggered by preinstall and a runtime entrypoint that exports SVG icon components. The network request is limited to the publisher’s license endpoint and carries the supplied license key with package identity; no attack behavior was identified.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package runs its preinstall hook; importing the package loads its exported icon entrypoint.
Impact
The request checks license validity; the inspected behavior establishes no unrelated collection or harmful runtime action.
Mechanism
The hook submits the supplied license key to the publisher’s license endpoint with this package’s identity. The inspected component renders SVG markup through shared helpers.
AI rationale
Source inspection shows a license check triggered by preinstall and a runtime entrypoint that exports SVG icon components. The network request is limited to the publisher’s license endpoint and carries the supplied license key with package identity; no attack behavior was identified.
Evidence
package.jsonlicense-check.jsindex.jsxindex.d.tsCentralIconBase.tsxIcon3d/index.tsx
Network endpoints1
centralicons.com/license/check
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest runs license-check.js during preinstall.
- The hook reads CENTRAL_LICENSE_KEY and sends it as a bearer credential with this package’s name and version to the publisher’s license endpoint.
- The hook checks the license response and catches errors; it invokes no other transfer shown in the inspected source.
- The runtime entrypoint reexports icon components, and the inspected component builds SVG markup using shared SVG helpers.
- The declaration entrypoint reexports icon declarations.
Evidence against
- The preinstall hook makes a network request using an environment-provided license key.
Behavioral surface
EnvironmentVarsNetwork
MinifiedUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./license-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg13"scripts": {
"preinstall": "node ./license-check.js",
"build": "node ./build.mjs",
"prepublishOnly": "npm run build",
"lint": "node ./build.mjs"
},
"peerDependencies": { "solid-j
Low
Ai Review Evidence
The manifest runs license-check.js during preinstall.
package.jsonView on unpkg · L13license-check.jsView file
•matchType = malicious_source_fingerprint_signature
signature = fd278436d357a415
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @central-icons-svelte/round-outlined-radius-0-stroke-1.5@1.1.320
matchedPath = license-check.js
matchedIdentity = npm:[redacted]:1.1.320
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
Findings
2 High2 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturelicense-check.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
LowAi Review Evidencelicense-check.js
Affected versions and remediation
This report applies to @central-icons-solid/square-outlined-radius-0-stroke-2@1.2.15.
See all versions of @central-icons-solid/square-outlined-radius-0-stroke-2 for other recorded verdicts.
- Review the evidence and your use of @central-icons-solid/square-outlined-radius-0-stroke-2@1.2.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.