registry / @eventcatalog/core / 4.10.13
@eventcatalog/core@4.10.13
<div align="center">
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk scanner matches resolve to configured telemetry, GitHub federation, and browser UI behavior. The manifest has no install lifecycle hooks or self-dependency, and source inspection found no concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs the EventCatalog CLI or opens configured catalog UI features.
Impact
No unconsented installation-time execution or credential exfiltration was found.
Mechanism
Feature-specific analytics, federation, and relative API requests.
AI rationale
The high-risk scanner matches resolve to configured telemetry, GitHub federation, and browser UI behavior. The manifest has no install lifecycle hooks or self-dependency, and source inspection found no concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a user-invoked CLI entrypoint.
- The CLI reports configured resource-count analytics and command metadata to vendor endpoints.
- The search UI uses Function only to perform a dynamic module import.
- The chat panel fetches its relative /api/chat endpoint when opened.
- GitHub tokens are used only for configured GitHub federation requests.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- There is no runtime dependency on @eventcatalog/core itself.
- No source evidence shows credential harvesting, foreign control-surface writes, persistence, or remote payload execution.
- The reported network operations are feature-specific telemetry, local API calls, or configured GitHub federation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltaeventcatalog/src/components/ChatPanel/ChatPanel.tsx
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @eventcatalog/core@4.10.13.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.10.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.