registry / @eventcatalog/core / 4.2.3
@eventcatalog/core@4.2.3
<div align="center">
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
137const loadPagefindModule = (url: string) => {
L138: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L139: return nativeImport(url);
Low
Eval
Package source references a known benign dynamic code generation pattern.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L137dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 High4 Medium6 Low
HighCopied Package Dependency Bridgedist/analytics/log-build.cjs
HighPrevious Version Dangerous Deltadist/eventcatalog.cjs
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaleventcatalog/src/components/Search/SearchModal.tsx
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @eventcatalog/core@4.2.3.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@4.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.