registry / @eventcatalog/core / 4.12.1
@eventcatalog/core@4.12.1
<div align="center">
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe scanner’s credential-transfer and dynamic-code flags resolve to gated product analytics, configured GitHub access, Pagefind module loading, and code highlighting. No install hook or concrete malicious behavior was found in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the EventCatalog development or build command; the cloud inventory report additionally requires analytics settings to be enabled and configured.
Impact
These behaviors support product analytics and catalog functionality; inspected source did not show credential theft or unrelated account changes.
Mechanism
The runtime sends catalog metadata and resource counts to analytics services. GitHub tokens are used by the federation provider for configured GitHub repository requests.
AI rationale
The scanner’s credential-transfer and dynamic-code flags resolve to gated product analytics, configured GitHub access, Pagefind module loading, and code highlighting. No install hook or concrete malicious behavior was found in the inspected source.
Evidence
package.jsonbin/eventcatalog.jsdist/eventcatalog.cjsdist/eventcatalog.jsdist/federation/source-provider.cjseventcatalog/src/components/Search/SearchModal.tsxeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx
Network endpoints3
queue.simpleanalyticscdn.com/eventsapi.ecingest.dev/v1/analytics/ingestapi.github.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and ordinary development/build scripts, with no install lifecycle hook; the CLI imports the bundled runtime.
- Build telemetry sends catalog metadata to analytics endpoints; cloud inventory reporting requires analytics to be enabled and both a tracking ID and write key.
- Flagged runtime action locations resolve to local search-index generation, file watching, and subprocess error handling in user-invoked CLI commands.
- SearchModal uses dynamic import to load the Pagefind module; ExamplesViewer passes code examples to a syntax highlighter.
- The federation provider sends a caller-configured GitHub token to GitHub’s API for configured repository content requests.
Evidence against
- The inspected source did not show credentials or environment contents being sent to the analytics endpoints.
- The flagged search-index locations write generated files under the catalog output directory; they do not perform account actions.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/chunk-EVXNBTRA.jsView file
41try {
L42: const importedGenerator = await import(plugin);
L43: const generator2 = getDefaultExport(importedGenerator);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-EVXNBTRA.jsView on unpkg · L41dist/eventcatalog.cjsView file
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/federation/source-provider.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/chunk-EVXNBTRA.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @eventcatalog/core@4.12.1.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.12.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.