registry / @eventcatalog/core / 5.0.0
@eventcatalog/core@5.0.0
<div align="center">
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no install lifecycle script, and the flagged runtime call sites perform local search-index and development tasks. The inspected UI source accounts for the eval-related scanner hints; no concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the CLI or starts catalog development workflows.
Impact
No credential disclosure, unauthorized account action, or install-time mutation was established.
Mechanism
The runtime writes search index files under the catalog output directory and can rebuild them when Markdown files change.
AI rationale
The manifest has no install lifecycle script, and the flagged runtime call sites perform local search-index and development tasks. The inspected UI source accounts for the eval-related scanner hints; no concrete attack behavior was established.
Evidence
package.jsondist/eventcatalog.cjsdist/eventcatalog.jseventcatalog/src/components/Search/SearchModal.tsxeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and lists development/build scripts; it contains no install lifecycle script.
- The flagged runtime locations build and write local Pagefind search indexes, watch Markdown files, and optionally prewarm the local homepage.
- The CLI entrypoint imports the package runtime; its flagged helper prepares the local catalog runtime.
- The search component inserts highlighted text as HTML, and the schema example component renders fenced code content.
- No malicious behavior was identified in the inspected source.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
138const loadPagefindModule = (url: string) => {
L139: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L140: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L138dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
1 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @eventcatalog/core@5.0.0.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@5.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.