registry / @getmicdrop/venue-calendar / 4.0.113
@getmicdrop/venue-calendar@4.0.113
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource is a Svelte venue-calendar widget with documented runtime API/analytics behavior. The static signals are package-aligned and do not form a malicious execution or exfiltration chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Browser import or loading a page with a calendar container/widget configuration.
Impact
Normal widget data retrieval and optional event tracking; no host compromise or credential exfiltration found.
Mechanism
calendar API calls and configured analytics telemetry
AI rationale
Source is a Svelte venue-calendar widget with documented runtime API/analytics behavior. The static signals are package-aligned and do not form a malicious execution or exfiltration chain.
Evidence
package.jsondist/venue-calendar.es.jsdist/VenueCalendar-DIAMhER4.jsdist/api/api.mjsREADME.md
Network endpoints3
get-micdrop.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime telemetry posts page/widget events with generated IDs, referrer, and URL.
- Optional configured pixels load Meta and Google analytics scripts.
Evidence against
- package.json has no preinstall/install/postinstall hook.
- Published package has no scripts/prepare.js despite the prepare entry; no install payload is present.
- Runtime API defaults to the package-aligned get-micdrop.com host.
- No filesystem/process, eval, credential-harvesting, or remote-code-loading behavior found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/venue-calendar.umd.jsView file
17patternName = generic_password
severity = medium
line = 17
matchedText = `&&f()}r...ne">
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/venue-calendar.umd.jsView on unpkg · L1729patternName = generic_password
severity = medium
line = 29
matchedText = ${L??""}...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L29dist/venue-calendar.iife.jsView file
32patternName = generic_password
severity = medium
line = 32
matchedText = `&&c()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.iife.js
Findings
12 Medium4 Low
MediumSecret Patterndist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/labels-CUDO5VqI.js
MediumSecret Patterndist/VenueCalendar-DIAMhER4.js
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.113.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.113 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.