registry / @eventcatalog/core / 5.0.1
@eventcatalog/core@5.0.1
<div align="center">
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe source does not support the malicious scanner label: the package has no install hook, and flagged credential use is scoped to GitHub source retrieval. The telemetry and dynamic-loading paths serve catalog features, while account-like markers resolve to local search-index operations.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Telemetry runs from normal CLI build, development, or start workflows; Pagefind loads when indexed search is opened.
Impact
No secret disclosure to an unrelated recipient or unrequested account change was identified.
Mechanism
The inspected network calls report catalog or build metadata and retrieve requested GitHub content. Dynamic loading targets the generated Pagefind asset.
AI rationale
The source does not support the malicious scanner label: the package has no install hook, and flagged credential use is scoped to GitHub source retrieval. The telemetry and dynamic-loading paths serve catalog features, while account-like markers resolve to local search-index operations.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares no install lifecycle hook; its CLI entry imports the shipped runtime.
- CLI telemetry sends EventCatalog build and catalog metadata. The standard event has a telemetry opt-out, and cloud inventory reporting requires enabled analytics configuration, a tracking ID, and a write key.
- The GitHub source provider sends its configured token to GitHub content endpoints for requested source retrieval.
- Account-like runtime markers resolve to local search-index construction, cleanup, and rebuild calls; the other runtime-operation markers resolve to local command handling and runtime preparation.
- The flagged dynamic import loads the generated Pagefind module when indexed search opens.
- The flagged example viewer passes displayed content to a syntax highlighter.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
138const loadPagefindModule = (url: string) => {
L139: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L140: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L138dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
1 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @eventcatalog/core@5.0.1.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@5.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.