registry / @eventcatalog/core / 4.11.0
@eventcatalog/core@4.11.0
<div align="center">
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe scanner’s dynamic-evaluation and runtime-action matches resolve to loading the generated Pagefind module and local search-index operations. Build analytics reports package-aligned usage metadata, while Cloud inventory reporting has explicit configuration gates; the inspected source does not establish a concrete attack surface.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the EventCatalog CLI build or development command; cloud inventory reporting additionally requires analytics to be enabled and configured.
Impact
The inspected behavior reports build and catalog usage metadata; it does not establish credential theft or an unrequested account action.
Mechanism
Build telemetry sends catalog metadata to an analytics collector. The separate Cloud inventory request sends aggregate resource counts only when configuration supplies its enable flag, tracking ID, and write key.
AI rationale
The scanner’s dynamic-evaluation and runtime-action matches resolve to loading the generated Pagefind module and local search-index operations. Build analytics reports package-aligned usage metadata, while Cloud inventory reporting has explicit configuration gates; the inspected source does not establish a concrete attack surface.
Evidence
package.jsonbin/eventcatalog.jsdist/eventcatalog.cjseventcatalog/src/components/Search/SearchModal.tsxeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx
Network endpoints2
queue.simpleanalyticscdn.com/eventsapi.ecingest.dev/v1/analytics/ingest
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and has no install lifecycle hook.
- The CLI builds a local Pagefind index from catalog records and writes it under the project output directory.
- Indexed search loads the generated local Pagefind module only when indexed search is active and the modal opens.
- The flagged example viewer renders supplied examples through ReactMarkdown and syntax highlighting.
- Build telemetry sends catalog metadata to an EventCatalog-branded analytics event; Cloud inventory reporting requires analytics.enabled, trackingId, and writeKey.
Evidence against
- The inspected runtime action matches are local search-index writes and rebuilds triggered by development or build activity.
- The reviewed credential-related code does not show catalog telemetry sending credentials; the reported hash is derived from catalog file paths and contents.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/eventcatalog.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @eventcatalog/core@4.11.0.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.