registry / @eventcatalog/core / 4.10.11
@eventcatalog/core@4.10.11
<div align="center">
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe flagged dynamic import is a local search-module loader, and telemetry is configuration-gated. The package has no install lifecycle hook or concrete malicious execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the package's catalog build functionality with cloud analytics enabled.
Impact
Configured analytics receives identifiers and aggregate catalog counts.
Mechanism
Configured telemetry POST of resource-count metadata.
AI rationale
The flagged dynamic import is a local search-module loader, and telemetry is configuration-gated. The package has no install lifecycle hook or concrete malicious execution chain.
Network endpoints1
api.ecingest.dev
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines development and build scripts but no npm install lifecycle hook.
- The search component dynamically imports a Pagefind module.
- Cloud inventory reporting is gated by enabled analytics settings and configured identifiers.
Evidence against
- No install-time execution or self-dependency chain is present.
- The dynamic import is used for the package's local Pagefind search asset.
- No credential harvesting, arbitrary payload execution, or destructive behavior was found in the inspected sources.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137137const loadPagefindModule = (url: string) => {
const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
return nativeImport(url);
};
Low
Ai Review Evidence
The search component dynamically imports a Pagefind module.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/migrations/message-channels-to-service-channels.cjsView file
Findings
1 Critical1 High3 Medium7 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceeventcatalog/src/components/Search/SearchModal.tsx
Affected versions and remediation
This report applies to @eventcatalog/core@4.10.11.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.10.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.