registry / @eventcatalog/core / 4.2.1

@eventcatalog/core@4.2.1

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 364 file(s), 2.11 MB of source, external domains: api.ecingest.dev, app.eventcatalog.studio, eventcatalog.cloud, eventcatalog.dev, eventcatalog.studio, example.com, github.com, prod.example.com, queue.simpleanalyticscdn.com, uat.example.com, www.eventcatalog.dev, www.plantuml.com, www.w3.org

Source & flagged code

4 flagged

eventcatalog/src/components/Search/SearchModal.tsxView file

Lines 117-157tsx

117 options?: (options: Record<string, unknown>) => Promise<void>;

118 debouncedSearch: (term: string) => Promise<{ results: Array<{ id: string; score?: number; data: () => Promise<any> }> } | null>;

119}

120

121const normalizeSearchIndexPayload = (payload: SearchIndexPayload): SearchNode[] => {

122 if (payload.i) {

123 return payload.i.map((item) => ({

124 key: item.k,

125 title: item.t,

126 badge: item.b,

127 summary: item.s,

128 href: item.h,

129 icon: item.i,

130 leftIcon: item.li,

131 }));

132 }

133

134 return payload.items || [];

135};

136

137const loadPagefindModule = (url: string) => {

138 const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;

139 return nativeImport(url);

Low

Eval

Package source references a known benign dynamic code generation pattern.

eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137

140};

141

142export default function SearchModal() {

143 const searchType = typeof __EC_SEARCH_TYPE__ !== 'undefined' ? __EC_SEARCH_TYPE__ : 'resource';

144 const isIndexedSearch = searchType === 'indexed';

145 const [query, setQuery] = useState('');

146 const [open, setOpen] = useState(false);

147 const [activeFilter, setActiveFilter] = useState('all');

148 const [searchNodes, setSearchNodes] = useState<SearchNode[]>([]);

149 const [indexedItems, setIndexedItems] = useState<SearchItem[]>([]);

150 const [pagefind, setPagefind] = useState<PagefindModule | null>(null);

151 const [isSearchingIndexed, setIsSearchingIndexed] = useState(false);

152 const [isLoadingSearchIndex, setIsLoadingSearchIndex] = useState(false);

153 const [searchIndexLoadError, setSearchIndexLoadError] = useState<string | null>(null);

154 const favorites = useStore(favoritesStore);

155 const inputRef = useRef<HTMLInputElement>(null);

156

157 useEffect(() => {

dist/migrations/message-channels-to-service-channels.cjsView file

Lines 15-55javascript

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

dist/analytics/log-build.cjsView file

Lines 159-199javascript

159 metadata: {

160 ...eventData,

161 t: `t;${(/* @__PURE__ */ new Date()).toISOString()}`,

162 ua: userAgent

163 },

164 ua: userAgent

dist/eventcatalog.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @eventcatalog/core@3.48.4 matchedIdentity = npm:QGV2ZW50Y2F0YWxvZy9jb3Jl:3.48.4 similarity = 0.717 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eventcatalog.cjsView on unpkg

Source & flagged code

4 flagged · loading source

eventcatalog/src/components/Search/SearchModal.tsxView file

137const loadPagefindModule = (url: string) => { L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>; L139: return nativeImport(url);

Low

Eval

Package source references a known benign dynamic code generation pattern.

eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137

dist/migrations/message-channels-to-service-channels.cjsView file

35module.exports = __toCommonJS(message_channels_to_service_channels_exports); L36: var import_node_fs = __toESM(require("fs"), 1); L37: var import_glob = require("glob");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35

dist/analytics/log-build.cjsView file

179package = @eventcatalog/core; repositoryIdentity = eventcatalog; dependency = glob L179: // src/analytics/count-resources.js L180: var import_glob = require("glob"); L181: var RESOURCE_PATTERNS = {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/analytics/log-build.cjsView on unpkg · L179

dist/eventcatalog.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eventcatalog.cjsView on unpkg

Findings

2 High4 Medium6 Low

HighCopied Package Dependency Bridgedist/analytics/log-build.cjs

HighPrevious Version Dangerous Deltadist/eventcatalog.cjs

MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaleventcatalog/src/components/Search/SearchModal.tsx

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

eventcatalog/src/components/Search/SearchModal.tsxView file

Lines 117-157tsx

117 options?: (options: Record<string, unknown>) => Promise<void>;

118 debouncedSearch: (term: string) => Promise<{ results: Array<{ id: string; score?: number; data: () => Promise<any> }> } | null>;

119}

120

121const normalizeSearchIndexPayload = (payload: SearchIndexPayload): SearchNode[] => {

122 if (payload.i) {

123 return payload.i.map((item) => ({

124 key: item.k,

125 title: item.t,

126 badge: item.b,

127 summary: item.s,

128 href: item.h,

129 icon: item.i,

130 leftIcon: item.li,

131 }));

132 }

133

134 return payload.items || [];

135};

136

137const loadPagefindModule = (url: string) => {

138 const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;

139 return nativeImport(url);

Low

Eval

Package source references a known benign dynamic code generation pattern.

eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137

140};

141

142export default function SearchModal() {

143 const searchType = typeof __EC_SEARCH_TYPE__ !== 'undefined' ? __EC_SEARCH_TYPE__ : 'resource';

144 const isIndexedSearch = searchType === 'indexed';

145 const [query, setQuery] = useState('');

146 const [open, setOpen] = useState(false);

147 const [activeFilter, setActiveFilter] = useState('all');

148 const [searchNodes, setSearchNodes] = useState<SearchNode[]>([]);

149 const [indexedItems, setIndexedItems] = useState<SearchItem[]>([]);

150 const [pagefind, setPagefind] = useState<PagefindModule | null>(null);

151 const [isSearchingIndexed, setIsSearchingIndexed] = useState(false);

152 const [isLoadingSearchIndex, setIsLoadingSearchIndex] = useState(false);

153 const [searchIndexLoadError, setSearchIndexLoadError] = useState<string | null>(null);

154 const favorites = useStore(favoritesStore);

155 const inputRef = useRef<HTMLInputElement>(null);

156

157 useEffect(() => {

dist/migrations/message-channels-to-service-channels.cjsView file

Lines 15-55javascript

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

dist/analytics/log-build.cjsView file

Lines 159-199javascript

159 metadata: {

160 ...eventData,

161 t: `t;${(/* @__PURE__ */ new Date()).toISOString()}`,

162 ua: userAgent

163 },

164 ua: userAgent

dist/eventcatalog.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/eventcatalog.cjsView on unpkg