registry / @eventcatalog/core / 4.2.0
@eventcatalog/core@4.2.0
⚠ Under review<div align="center">
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/eventcatalog.jsView file
48import { Command } from "commander";
L49: import { execSync, spawn } from "child_process";
L50: import { join } from "path";
High
Child Process
Package source references child process execution.
dist/eventcatalog.jsView on unpkg · L48762},
L763: shell: true,
L764: stdio: ["inherit", "pipe", "pipe"]
High
1026}) => {
L1027: execSync(
L1028: `cross-env PROJECT_DIR='${dir}' CATALOG_DIR='${core}' ENABLE_EMBED=${canEmbedPages} EVENTCATALOG_STARTER=${isEventCatalogStarter} EVENTCATALOG_SCALE=${isEventCatalogScale} npx astr...
L1029: {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/eventcatalog.jsView on unpkg · L1026Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/eventcatalog.cjs
HighChild Processdist/eventcatalog.js
HighShelldist/eventcatalog.js
HighCopied Package Dependency Bridgedist/analytics/log-build.cjs
HighRuntime Package Installdist/eventcatalog.js
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaleventcatalog/src/components/Search/SearchModal.tsx
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @eventcatalog/core@4.2.0.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.