registry / @eventcatalog/core / 5.7.1
@eventcatalog/core@5.7.1
<div align="center">
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe flagged token is used for configured GitHub federation and sent only to GitHub endpoints. Analytics reports product metadata and resource counts, with cloud inventory gated by explicit configuration; no malicious credential exfiltration or unrelated automatic action was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Analytics runs during CLI build or development activity; cloud inventory reporting requires enabled cloud analytics. GitHub access occurs when the user runs the federation command with configured sources.
Impact
No credential transfer to an unrelated host or other malicious behavior was identified.
Mechanism
Telemetry sends product and catalog metadata to its analytics collector. A configured GitHub token is sent to GitHub API requests for GitHub federation sources.
AI rationale
The flagged token is used for configured GitHub federation and sent only to GitHub endpoints. Analytics reports product metadata and resource counts, with cloud inventory gated by explicit configuration; no malicious credential exfiltration or unrelated automatic action was identified.
Network endpoints4
api.ecingest.dev/v1/analytics/ingestqueue.simpleanalyticscdn.com/eventsapi.github.com/repos/{owner}/{repository}/contents/{path}?ref={ref}raw.githubusercontent.com/{owner}/{repository}/{ref}/{path}
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Cloud analytics sends only when configuration explicitly enables it and supplies a tracking ID and write key; its report contains resource counts.
- The GitHub token is attached to requests to GitHub API URLs for configured GitHub federation sources.
- Federation runs through an explicit `eventcatalog federate` command.
- Dynamic import in SearchModal loads the Pagefind search module from a URL; no `eval` call was found.
Evidence against
- Default telemetry can send organization and catalog identifiers, a content hash, feature data, and resource counts to the analytics collector; telemetry can be disabled by config or environment.
- The package contains a configured cloud analytics endpoint, but its inventory report is gated by `cloud.analytics.enabled` and sends counts rather than catalog contents.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
6 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
138const loadPagefindModule = (url: string) => {
L139: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L140: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L138dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical3 High4 Medium4 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/eventcatalog.js
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighCopied Package Dependency Bridgedist/chunk-YRZK7HKX.js
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @eventcatalog/core@5.7.1.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@5.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.