registry / @eventcatalog/core / 4.10.14
@eventcatalog/core@4.10.14
<div align="center">
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe scanner’s account-action matches are local search-index operations, and the dynamic import supports indexed search. The build telemetry is product-related; no concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Using the CLI to build a catalog triggers build telemetry; enabling cloud analytics with the required configuration triggers inventory reporting.
Impact
Build metadata and catalog metrics are disclosed to analytics services, but the inspected source does not establish credential theft or unrequested account changes.
Mechanism
Telemetry sends build metadata to an analytics service. Cloud inventory reporting is gated by analytics configuration, and indexed search dynamically imports the catalog’s generated Pagefind module.
AI rationale
The scanner’s account-action matches are local search-index operations, and the dynamic import supports indexed search. The build telemetry is product-related; no concrete attack behavior was established.
Evidence
package.jsondist/eventcatalog.cjseventcatalog/src/components/Search/SearchModal.tsx
Network endpoints2
queue.simpleanalyticscdn.com/eventsapi.ecingest.dev/v1/analytics/ingest
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest registers a CLI and declares no npm lifecycle hook; the flagged account-action locations perform local search indexing and rebuilds.
- The reported dynamic code evaluation imports a generated Pagefind search module from the catalog’s local pagefind path.
- Build telemetry sends EventCatalog product and catalog metadata; separate cloud inventory reporting requires analytics to be enabled with a tracking ID and write key.
Evidence against
- Build telemetry is sent automatically and includes catalog identifiers and a content hash, but the inspected code shows no credential transfer or unrelated account action.
- The reported search evaluation loads the local Pagefind module used by the product’s indexed search feature.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/eventcatalog.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @eventcatalog/core@4.10.14.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.10.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.