registry / @eventcatalog/core / 3.48.4

@eventcatalog/core@3.48.4

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 342 file(s), 1.92 MB of source, external domains: api.ecingest.dev, app.eventcatalog.studio, eventcatalog.cloud, eventcatalog.dev, eventcatalog.studio, example.com, github.com, prod.example.com, queue.simpleanalyticscdn.com, uat.example.com, www.eventcatalog.dev, www.plantuml.com, www.w3.org

Source & flagged code

6 flagged

dist/eventcatalog.jsView file

Lines 24-64javascript

24 getProjectOutDir,

25 isAuthEnabled,

26 isIndexedSearchEnabled,

27 isOutputServer

28} from "./chunk-B7HCX5HM.js";

29import {

30 generate

31} from "./chunk-XNVSSL4W.js";

32import {

33 logger

34} from "./chunk-KDLSBQRP.js";

35import {

36 VERSION

37} from "./chunk-JY4H7A4S.js";

38import {

39 getEventCatalogConfigFile,

40 verifyRequiredFieldsAreInCatalogConfigFile

41} from "./chunk-6QENHZZP.js";

43// src/eventcatalog.ts

44import { Command } from "commander";

45import { execSync, spawn } from "child_process";

46import { join } from "path";

High

Child Process

Package source references child process execution.

dist/eventcatalog.jsView on unpkg · L44

47import http from "http";

48import fs3 from "fs";

49import path2 from "path";

50import { fileURLToPath } from "url";

51import boxen from "boxen";

52import updateNotifier from "update-notifier";

53import dotenv from "dotenv";

55// eventcatalog/src/enterprise/fields/field-indexer.ts

56import path from "path";

57import fs2 from "fs";

59// eventcatalog/src/enterprise/fields/fields-db.ts

60import initSqlJs from "sql.js";

61import fs from "fs";

62var SCHEMA_SQL = `

63 CREATE TABLE IF NOT EXISTS fields (

64 id INTEGER PRIMARY KEY AUTOINCREMENT,

Lines 738-778javascript

738var replaceAstroReadyVersionLine = (line) => {

739 const matches = line.match(/^(\s*)astro(\s+)v\S+(\s+ready.*)$/i);

740 if

Lines 995-1035javascript

995 });

996 if (await isIndexedSearchEnabled()) {

997 await warnIfIndexedSearchUsesAuth();

998 const config = await getEventCatalogConfigFile(dir);

999 const outDir = path2.resolve(dir, await getProjectOutDir());

eventcatalog/src/components/Search/SearchModal.tsxView file

Lines 117-157tsx

117 options?: (options: Record<string, unknown>) => Promise<void>;

118 debouncedSearch: (term: string) => Promise<{ results: Array<{ id: string; score

dist/migrations/message-channels-to-service-channels.cjsView file

Lines 15-55javascript

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

dist/analytics/log-build.cjsView file

Lines 159-199javascript

159 metadata: {

160 ...eventData,

161 t: `t;${(/* @__PURE__ */ new Date()).toISOString()}`,

162 ua: userAgent

163 },

164 ua: userAgent

Source & flagged code

6 flagged · loading source

dist/eventcatalog.jsView file

44import { Command } from "commander"; L45: import { execSync, spawn } from "child_process"; L46: import { join } from "path";

High

Child Process

Package source references child process execution.

dist/eventcatalog.jsView on unpkg · L44

758}, L759: shell: true, L760: stdio: ["inherit", "pipe", "pipe"]

High

Shell

Package source references shell execution.

dist/eventcatalog.jsView on unpkg · L758

1015}) => { L1016: execSync( L1017: `cross-env PROJECT_DIR='${dir}' CATALOG_DIR='${core}' ENABLE_EMBED=${canEmbedPages} EVENTCATALOG_STARTER=${isEventCatalogStarter} EVENTCATALOG_SCALE=${isEventCatalogScale} npx astr... L1018: {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/eventcatalog.jsView on unpkg · L1015

eventcatalog/src/components/Search/SearchModal.tsxView file

137const loadPagefindModule = (url: string) => { L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>; L139: return nativeImport(url);

Low

Eval

Package source references a known benign dynamic code generation pattern.

eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137

dist/migrations/message-channels-to-service-channels.cjsView file

35module.exports = __toCommonJS(message_channels_to_service_channels_exports); L36: var import_node_fs = __toESM(require("fs"), 1); L37: var import_glob = require("glob");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35

dist/analytics/log-build.cjsView file

179package = @eventcatalog/core; repositoryIdentity = eventcatalog; dependency = glob L179: // src/analytics/count-resources.js L180: var import_glob = require("glob"); L181: var RESOURCE_PATTERNS = {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/analytics/log-build.cjsView on unpkg · L179

Findings

4 High4 Medium6 Low

HighChild Processdist/eventcatalog.js

HighShelldist/eventcatalog.js

HighCopied Package Dependency Bridgedist/analytics/log-build.cjs

HighRuntime Package Installdist/eventcatalog.js

MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaleventcatalog/src/components/Search/SearchModal.tsx

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/eventcatalog.jsView file

Lines 24-64javascript

24 getProjectOutDir,

25 isAuthEnabled,

26 isIndexedSearchEnabled,

27 isOutputServer

28} from "./chunk-B7HCX5HM.js";

29import {

30 generate

31} from "./chunk-XNVSSL4W.js";

32import {

33 logger

34} from "./chunk-KDLSBQRP.js";

35import {

36 VERSION

37} from "./chunk-JY4H7A4S.js";

38import {

39 getEventCatalogConfigFile,

40 verifyRequiredFieldsAreInCatalogConfigFile

41} from "./chunk-6QENHZZP.js";

43// src/eventcatalog.ts

44import { Command } from "commander";

45import { execSync, spawn } from "child_process";

46import { join } from "path";

High

Child Process

Package source references child process execution.

dist/eventcatalog.jsView on unpkg · L44

47import http from "http";

48import fs3 from "fs";

49import path2 from "path";

50import { fileURLToPath } from "url";

51import boxen from "boxen";

52import updateNotifier from "update-notifier";

53import dotenv from "dotenv";

55// eventcatalog/src/enterprise/fields/field-indexer.ts

56import path from "path";

57import fs2 from "fs";

59// eventcatalog/src/enterprise/fields/fields-db.ts

60import initSqlJs from "sql.js";

61import fs from "fs";

62var SCHEMA_SQL = `

63 CREATE TABLE IF NOT EXISTS fields (

64 id INTEGER PRIMARY KEY AUTOINCREMENT,

Lines 738-778javascript

738var replaceAstroReadyVersionLine = (line) => {

739 const matches = line.match(/^(\s*)astro(\s+)v\S+(\s+ready.*)$/i);

740 if

Lines 995-1035javascript

995 });

996 if (await isIndexedSearchEnabled()) {

997 await warnIfIndexedSearchUsesAuth();

998 const config = await getEventCatalogConfigFile(dir);

999 const outDir = path2.resolve(dir, await getProjectOutDir());

eventcatalog/src/components/Search/SearchModal.tsxView file

Lines 117-157tsx

117 options?: (options: Record<string, unknown>) => Promise<void>;

118 debouncedSearch: (term: string) => Promise<{ results: Array<{ id: string; score

dist/migrations/message-channels-to-service-channels.cjsView file

Lines 15-55javascript

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

dist/analytics/log-build.cjsView file

Lines 159-199javascript

159 metadata: {

160 ...eventData,

161 t: `t;${(/* @__PURE__ */ new Date()).toISOString()}`,

162 ua: userAgent

163 },

164 ua: userAgent