registry / @eventcatalog/core / 5.7.2
@eventcatalog/core@5.7.2
<div align="center">
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe scanner's credential finding resolves to federation code that sends a configured GitHub token to GitHub to retrieve the selected source. The observed analytics is tied to CLI operations, and cloud inventory reporting requires explicit analytics configuration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Invoking EventCatalog build, dev, or start can send telemetry; invoking the federate command fetches configured catalogs.
Impact
The observed network activity is limited to usage analytics and retrieving the user's configured federated catalogs; no credential transfer to a foreign host was found.
Mechanism
Telemetry sends EventCatalog usage metadata to analytics endpoints. Federation sends a configured GitHub token to GitHub when requesting configured GitHub content.
AI rationale
The scanner's credential finding resolves to federation code that sends a configured GitHub token to GitHub to retrieve the selected source. The observed analytics is tied to CLI operations, and cloud inventory reporting requires explicit analytics configuration.
Network endpoints5
api.ecingest.devqueue.simpleanalyticscdn.comapi.github.comraw.githubusercontent.comgithub.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI entry point that imports the EventCatalog CLI bundle.
- Federation obtains an explicitly configured GitHub token and uses it for requests to GitHub source URLs.
- Federation is a named command for fetching catalogs configured in federation.sources.
- Standard telemetry can be disabled with EVENTCATALOG_TELEMETRY_DISABLED, DO_NOT_TRACK, or telemetry: false.
- Cloud inventory analytics requires enabled configuration, a tracking ID, and a write key; its payload contains resource counts.
Evidence against
- No install lifecycle scripts are declared in the package metadata.
- The inspected analytics payload does not include GitHub credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
138const loadPagefindModule = (url: string) => {
L139: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L140: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L138dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
2 Critical3 High4 Medium4 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
CriticalPrevious Version Dangerous Deltadist/eventcatalog.js
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighCopied Package Dependency Bridgedist/chunk-YRZK7HKX.js
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @eventcatalog/core@5.7.2.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@5.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.