registry / @central-icons-svelte/round-outlined-radius-0-stroke-1 / 1.1.317

@central-icons-svelte/round-outlined-radius-0-stroke-1@1.1.317

A collection of round outlined Svelte icons with 0px radius and 1px stroke width, designed for use in Svelte applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package invokes a script that transmits a license credential to a remote host. This is automatic credential exfiltration during npm installation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, through the preinstall lifecycle hook.

Impact

The CENTRAL_LICENSE_KEY available to the installer is disclosed to centralicons.com without an explicit user command.

Mechanism

Reads an environment credential and posts it in an Authorization header.

Attack narrative

The package defines a preinstall hook, so npm runs license-check.js automatically. That script reads CENTRAL_LICENSE_KEY from the environment and sends it as a Bearer token in a POST request to centralicons.com. The code labels this as a license check, but source text does not establish informed consent for sending an environment credential during installation.

Rationale

The automatic lifecycle hook exfiltrates an environment credential to a remote endpoint. The otherwise static SVG icon source does not mitigate this install-time behavior.

Evidence

package.jsonlicense-check.js

Network endpoints1

centralicons.com/license/check

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence with false-positive risk.

@central-icons-svelte/round-outlined-radius-0-stroke-1@1.1.317

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code