registry / @central-icons-solid/square-outlined-radius-0-stroke-2 / 1.2.16

@central-icons-solid/square-outlined-radius-0-stroke-2@1.2.16

⚠ Under review

A collection of square outlined Solid icons with 0px radius and 2px stroke width, designed for use in Solid applications.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The inspected lifecycle behavior is a package-specific license check directed to the vendor’s endpoint, with no separate attack behavior found in package-wide searches. Clean classification requires citations for more paths than the 128-citation limit permits, so this remains unresolved for review.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Package installation runs the preinstall hook.

Impact

The configured license key is disclosed to the package vendor for validation; the inspected request is package-specific and no unrelated collection or recipient was found.

Mechanism

The hook reads CENTRAL_LICENSE_KEY and sends it as a bearer credential in a license-check request to centralicons.com.

AI rationale

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.

AI review observations

The preinstall hook runs license-check.js during installation.
license-check.js reads CENTRAL_LICENSE_KEY from the environment.
The hook posts the key to centralicons.com for a package license check.
The main package exports Solid icon components through index.jsx and per-icon files.

Evidence against

The inspected license request names this package and version, and the manifest identifies Central Icons as the package homepage.
Package-wide searches found no other fetch, environment access, shell, or eval matches.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 2,149 file(s), 3.92 MB of source, external domains: centralicons.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-23json

2 "name": "@central-icons-solid/square-outlined-radius-0-stroke-2",

3 "version": "1.2.16",

4 "license": "SEE LICENSE IN LICENSE.md",

5 "homepage": "https://iconists.co/central",

6 "sideEffects": false,

7 "types": "./index.d.ts",

8 "exports": {

9 ".": { "solid": "./index.jsx", "types": "./index.d.ts", "default": "./index.jsx" },

10 "./*": { "solid": "./*/index.tsx", "types": "./*/index.d.ts", "default": "./*/index.tsx" }

Low

Ai Review Evidence

The main package exports Solid icon components through index.jsx and per-icon files.

package.jsonView on unpkg · L8

11 },

12 "files": ["**/*.tsx", "**/*.jsx", "**/*.ts", "**/*.d.ts", "**/*.md", "icons-index.json", "license-check.js"],

13 "scripts": {

14 "preinstall": "node ./license-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "build": "node ./build.mjs",

16 "prepublishOnly": "npm run build",

Low

Suspicious Lifecycle Evidence

The preinstall hook runs license-check.js during installation.

package.jsonView on unpkg · L14

17 "lint": "node ./build.mjs"

18 },

19 "peerDependencies": { "solid-js": ">=1.6" },

20 "keywords": ["solid", "solid-js", "icons", "svg", "central-icons", "icon-pack"],

21 "author": "Iconists"

22}

license-check.jsView file

Lines 1-33javascript

1const licenseKey = process.env.CENTRAL_LICENSE_KEY;

3if (!licenseKey) {

4 throw new Error(

5 "Central Icons license key is not set. Please set CENTRAL_LICENSE_KEY in your environment"

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./license-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

14"preinstall": "node ./license-check.js", "build": "node ./build.mjs",

Low

Suspicious Lifecycle Evidence

The preinstall hook runs license-check.js during installation.

package.jsonView on unpkg · L14

8"exports": { ".": { "solid": "./index.jsx", "types": "./index.d.ts", "default": "./index.jsx" }, "./*": { "solid": "./*/index.tsx", "types": "./*/in

Low

Ai Review Evidence

The main package exports Solid icon components through index.jsx and per-icon files.

package.jsonView on unpkg · L8

license-check.jsView file

Findings

2 High2 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturelicense-check.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencelicense-check.js

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to @central-icons-solid/square-outlined-radius-0-stroke-2@1.2.16.

See all versions of @central-icons-solid/square-outlined-radius-0-stroke-2 for other recorded verdicts.

Review the evidence and your use of @central-icons-solid/square-outlined-radius-0-stroke-2@1.2.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 12:21:40.488Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @central-icons-solid

Behavioral surface

Related packages

More from @central-icons-solid

Source & flagged code