registry / @eventcatalog/core / 4.12.3
@eventcatalog/core@4.12.3
<div align="center">
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe scanner flags resolve to package-aligned search, analytics, and GitHub federation behavior. The analytics send is guarded by explicit configuration, and the GitHub token is used for GitHub requests; no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs build or development functions, or a user opens indexed search or configures GitHub federation.
Impact
No confirmed attack surface was established from the inspected source.
Mechanism
Search code loads the Pagefind module; analytics sends resource counts only when enabled with configured identifiers; federation sends configured tokens to GitHub endpoints.
AI rationale
The scanner flags resolve to package-aligned search, analytics, and GitHub federation behavior. The analytics send is guarded by explicit configuration, and the GitHub token is used for GitHub requests; no malicious behavior was identified.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the CLI entrypoint and has no install lifecycle hook.
- The flagged runtime locations build or refresh the local Pagefind search index; they do not perform account actions.
- SearchModal uses dynamic import to load the Pagefind module for indexed search.
- Cloud inventory reporting requires analytics.enabled, trackingId, and writeKey, and sends resource counts.
- Federation uses configured GitHub credentials for GitHub API or raw GitHub requests.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/federation/source-provider.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @eventcatalog/core@4.12.3.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.12.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.