registry / @eventcatalog/core / 4.1.1

@eventcatalog/core@4.1.1

⚠ Under review

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 359 file(s), 2.08 MB of source, external domains: api.ecingest.dev, app.eventcatalog.studio, eventcatalog.cloud, eventcatalog.dev, eventcatalog.studio, example.com, github.com, prod.example.com, queue.simpleanalyticscdn.com, uat.example.com, www.eventcatalog.dev, www.plantuml.com, www.w3.org

Source & flagged code

7 flagged

dist/eventcatalog.jsView file

Lines 28-68javascript

28import "./chunk-W5JQON7Z.js";

29import {

30 VERSION

31} from "./chunk-5VJKDWMT.js";

32import {

33 linkCoreNodeModules,

34 resolveInstalledCoreNodeModules

35} from "./chunk-BWN544LB.js";

36import {

37 getProjectOutDir,

38 isAuthEnabled,

39 isIndexedSearchEnabled,

40 isOutputServer

41} from "./chunk-B7HCX5HM.js";

42import {

43 getEventCatalogConfigFile,

44 verifyRequiredFieldsAreInCatalogConfigFile

45} from "./chunk-6QENHZZP.js";

47// src/eventcatalog.ts

48import { Command } from "commander";

49import { execSync, spawn } from "child_process";

50import { join } from "path";

High

Child Process

Package source references child process execution.

dist/eventcatalog.jsView on unpkg · L48

51import http from "http";

52import fs3 from "fs";

53import path2 from "path";

54import { fileURLToPath } from "url";

55import boxen from "boxen";

56import updateNotifier from "update-notifier";

57import dotenv from "dotenv";

59// eventcatalog/src/enterprise/fields/field-indexer.ts

60import path from "path";

61import fs2 from "fs";

63// eventcatalog/src/enterprise/fields/fields-db.ts

64import initSqlJs from "sql.js";

65import fs from "fs";

66var SCHEMA_SQL = `

67 CREATE TABLE IF NOT EXISTS fields (

68 id INTEGER PRIMARY KEY AUTOINCREMENT,

Lines 742-782javascript

742var replaceAstroReadyVersionLine = (line) => {

743 const matches = line.match(/^(\s*)astro(\s+)v\S+(\s+ready.*)$/i);

744 if

Lines 1006-1046javascript

1006 });

1007 if (await isIndexedSearchEnabled()) {

1008 await warnIfIndexedSearchUsesAuth();

1009 const config = await getEventCatalogConfigFile(dir);

1010 const outDir = path2.resolve(dir, await getProjectOutDir

eventcatalog/src/components/Search/SearchModal.tsxView file

Lines 117-157tsx

117 options?: (options: Record<string, unknown>) => Promise<void>;

118 debouncedSearch: (term: string) => Promise<{ results: Array<{ id: string; score

dist/migrations/message-channels-to-service-channels.cjsView file

Lines 15-55javascript

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

dist/analytics/log-build.cjsView file

Lines 159-199javascript

159 metadata: {

160 ...eventData,

161 t: `t;${(/* @__PURE__ */ new Date()).toISOString()}`,

162 ua: userAgent

163 },

164 ua: userAgent

dist/eventcatalog.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @eventcatalog/core@3.48.4 matchedIdentity = npm:QGV2ZW50Y2F0YWxvZy9jb3Jl:3.48.4 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eventcatalog.cjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/eventcatalog.jsView file

48import { Command } from "commander"; L49: import { execSync, spawn } from "child_process"; L50: import { join } from "path";

High

Child Process

Package source references child process execution.

dist/eventcatalog.jsView on unpkg · L48

762}, L763: shell: true, L764: stdio: ["inherit", "pipe", "pipe"]

High

Shell

Package source references shell execution.

dist/eventcatalog.jsView on unpkg · L762

1026}) => { L1027: execSync( L1028: `cross-env PROJECT_DIR='${dir}' CATALOG_DIR='${core}' ENABLE_EMBED=${canEmbedPages} EVENTCATALOG_STARTER=${isEventCatalogStarter} EVENTCATALOG_SCALE=${isEventCatalogScale} npx astr... L1029: {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/eventcatalog.jsView on unpkg · L1026

eventcatalog/src/components/Search/SearchModal.tsxView file

137const loadPagefindModule = (url: string) => { L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>; L139: return nativeImport(url);

Low

Eval

Package source references a known benign dynamic code generation pattern.

eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137

dist/migrations/message-channels-to-service-channels.cjsView file

35module.exports = __toCommonJS(message_channels_to_service_channels_exports); L36: var import_node_fs = __toESM(require("fs"), 1); L37: var import_glob = require("glob");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35

dist/analytics/log-build.cjsView file

179package = @eventcatalog/core; repositoryIdentity = eventcatalog; dependency = glob L179: // src/analytics/count-resources.js L180: var import_glob = require("glob"); L181: var RESOURCE_PATTERNS = {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/analytics/log-build.cjsView on unpkg · L179

dist/eventcatalog.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eventcatalog.cjsView on unpkg

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/eventcatalog.cjs

HighChild Processdist/eventcatalog.js

HighShelldist/eventcatalog.js

HighCopied Package Dependency Bridgedist/analytics/log-build.cjs

HighRuntime Package Installdist/eventcatalog.js

MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaleventcatalog/src/components/Search/SearchModal.tsx

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/eventcatalog.jsView file

Lines 28-68javascript

28import "./chunk-W5JQON7Z.js";

29import {

30 VERSION

31} from "./chunk-5VJKDWMT.js";

32import {

33 linkCoreNodeModules,

34 resolveInstalledCoreNodeModules

35} from "./chunk-BWN544LB.js";

36import {

37 getProjectOutDir,

38 isAuthEnabled,

39 isIndexedSearchEnabled,

40 isOutputServer

41} from "./chunk-B7HCX5HM.js";

42import {

43 getEventCatalogConfigFile,

44 verifyRequiredFieldsAreInCatalogConfigFile

45} from "./chunk-6QENHZZP.js";

47// src/eventcatalog.ts

48import { Command } from "commander";

49import { execSync, spawn } from "child_process";

50import { join } from "path";

High

Child Process

Package source references child process execution.

dist/eventcatalog.jsView on unpkg · L48

51import http from "http";

52import fs3 from "fs";

53import path2 from "path";

54import { fileURLToPath } from "url";

55import boxen from "boxen";

56import updateNotifier from "update-notifier";

57import dotenv from "dotenv";

59// eventcatalog/src/enterprise/fields/field-indexer.ts

60import path from "path";

61import fs2 from "fs";

63// eventcatalog/src/enterprise/fields/fields-db.ts

64import initSqlJs from "sql.js";

65import fs from "fs";

66var SCHEMA_SQL = `

67 CREATE TABLE IF NOT EXISTS fields (

68 id INTEGER PRIMARY KEY AUTOINCREMENT,

Lines 742-782javascript

742var replaceAstroReadyVersionLine = (line) => {

743 const matches = line.match(/^(\s*)astro(\s+)v\S+(\s+ready.*)$/i);

744 if

Lines 1006-1046javascript

1006 });

1007 if (await isIndexedSearchEnabled()) {

1008 await warnIfIndexedSearchUsesAuth();

1009 const config = await getEventCatalogConfigFile(dir);

1010 const outDir = path2.resolve(dir, await getProjectOutDir

eventcatalog/src/components/Search/SearchModal.tsxView file

Lines 117-157tsx

117 options?: (options: Record<string, unknown>) => Promise<void>;

118 debouncedSearch: (term: string) => Promise<{ results: Array<{ id: string; score

dist/migrations/message-channels-to-service-channels.cjsView file

Lines 15-55javascript

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

dist/analytics/log-build.cjsView file

Lines 159-199javascript

159 metadata: {

160 ...eventData,

161 t: `t;${(/* @__PURE__ */ new Date()).toISOString()}`,

162 ua: userAgent

163 },

164 ua: userAgent

dist/eventcatalog.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eventcatalog.cjsView on unpkg