@eventcatalog/core@5.8.0
<div align="center">
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe GitHub token flow is consistent with authenticated access to configured GitHub sources, but separate runtime telemetry sends identifying catalog metadata to an analytics endpoint by default. This is suspicious telemetry, not evidence of credential theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running a build, development server, or server startup.
Impact
An external analytics service receives organization and catalog identifiers and catalog-derived operational metadata without an explicit opt-in.
Mechanism
The package posts command and catalog metadata to Simple Analytics unless telemetry is disabled; separately configured cloud analytics can send resource counts to its configured endpoint.
AI rationale
The GitHub token flow is consistent with authenticated access to configured GitHub sources, but separate runtime telemetry sends identifying catalog metadata to an analytics endpoint by default. This is suspicious telemetry, not evidence of credential theft.
Evidence
dist/eventcatalog.cjs
Network endpoints2
queue.simpleanalyticscdn.com/eventsapi.ecingest.dev/v1/analytics/ingest
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry posts to queue.simpleanalyticscdn.com and runs unless telemetry is disabled by configuration or environment variables.
- The telemetry payload includes organization and catalog IDs, license-related details, a content hash, resource counts, directory sources, and feature information.
- The CLI calls the telemetry routine during builds; related calls also run during development and server startup.
Evidence against
- GitHub tokens are used for authenticated requests in the GitHub federation provider, consistent with fetching configured GitHub sources.
- Separate cloud resource analytics requires an enabled configuration with a tracking ID and write key.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggedeventcatalog/src/components/Search/SearchModal.tsxView file
138const loadPagefindModule = (url: string) => {
L139: const nativeImport = new Function('url', 'return import(url)') as (url: string) => Promise<PagefindModule>;
L140: return nativeImport(url);
High
Eval
Package source references dynamic code evaluation.
eventcatalog/src/components/Search/SearchModal.tsxView on unpkg · L138dist/migrations/message-channels-to-service-channels.cjsView file
35module.exports = __toCommonJS(message_channels_to_service_channels_exports);
L36: var import_node_fs = __toESM(require("fs"), 1);
L37: var import_glob = require("glob");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/migrations/message-channels-to-service-channels.cjsView on unpkg · L35Findings
1 Critical3 High4 Medium4 Low
CriticalCredential Exfiltrationdist/eventcatalog.cjs
HighEvaleventcatalog/src/components/Search/SearchModal.tsx
HighCopied Package Dependency Bridgedist/chunk-YRZK7HKX.js
HighSemantic Analysis Limitedeventcatalog/src/components/SchemaExplorer/ExamplesViewer.tsx#virtual:normalized:round1
MediumDynamic Requiredist/migrations/message-channels-to-service-channels.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @eventcatalog/core@5.8.0.
See all versions of @eventcatalog/core for other recorded verdicts.
- Review the evidence and your use of @eventcatalog/core@5.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.