registry / @eventcatalog/core / 5.5.1
@eventcatalog/core@5.5.1
<div align="center">
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe scanner’s credential and dynamic-code alerts are not supported by the inspected source: the observed requests carry analytics data, and cloud reporting requires explicit configuration. The package’s runtime entry and flagged UI and storage sources are consistent with a CLI and catalog application.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running EventCatalog build reporting; cloud inventory reporting additionally requires cloud analytics configuration.
Impact
The code reports product and catalog usage data; inspected paths do not establish credential theft, destructive behavior, or unauthorized account changes.
Mechanism
The CLI sends build metadata to an analytics service, and sends resource counts to the configured cloud analytics endpoint only when enabled with a tracking ID and write key.
AI rationale
The scanner’s credential and dynamic-code alerts are not supported by the inspected source: the observed requests carry analytics data, and cloud reporting requires explicit configuration. The package’s runtime entry and flagged UI and storage sources are consistent with a CLI and catalog application.
Evidence
package.jsonbin/eventcatalog.jsdist/eventcatalog.cjsdist/eventcatalog.js
Network endpoints2
queue.simpleanalyticscdn.com/eventsapi.ecingest.dev/v1/analytics/ingest
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest points its command-line entry to bin/eventcatalog.js, which imports the built CLI; the scanned UI files use normal React and Markdown components, and the database defaults to in-memory storage.
- The built CLI suppresses general analytics when telemetry opt-out settings are active and sends product event data to a fixed analytics service.
- Cloud inventory reporting requires cloud analytics to be enabled with a tracking ID and write key; its request sends resource counts to the configured endpoint or the package’s stated default.
- The telemetry calls are part of EventCatalog build reporting and include build metadata and resource counts; the inspected code does not show credential collection or an unrelated account action.
- The prepared dependency manifests and entry files identify the inspected packages as AI SDK and Astro integrations, with ordinary module imports in their runtime entry files.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
6 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
138const loadPagefindModule = (url: string) => {
L139: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L140: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L138dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical3 High4 Medium4 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/eventcatalog.js
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighCopied Package Dependency Bridgedist/chunk-YRZK7HKX.js
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @eventcatalog/core@5.5.1.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@5.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.