registry / @getmicdrop/venue-calendar / 4.0.115
@getmicdrop/venue-calendar@4.0.115
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is a browser-facing venue calendar with package-aligned ticketing APIs and configurable marketing pixels. Direct inspection found no concrete malicious chain or install-time payload.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer imports/mounts the calendar and uses its ticketing or analytics features.
Impact
No install-time mutation, credential harvesting, or unauthorized code execution established.
Mechanism
Browser API, checkout, attribution, and optional pixel requests.
AI rationale
The package is a browser-facing venue calendar with package-aligned ticketing APIs and configurable marketing pixels. Direct inspection found no concrete malicious chain or install-time payload.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-DPP0DBVa.jsdist/Checkout-BceqI7nY.js
Network endpoints4
get-micdrop.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=js.stripe.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- The declared prepare target scripts/prepare.js is absent from the package.
- Entrypoints implement a Svelte calendar, public API, cart, and checkout flows.
- No child-process, eval, native loading, credential-file access, or AI-agent configuration writes found.
- Tracking and API calls are browser-runtime feature code, not install-time behavior.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/venue-calendar.umd.jsView file
17patternName = generic_password
severity = medium
line = 17
matchedText = `&&f()}r...ne">
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/venue-calendar.umd.jsView on unpkg · L1729patternName = generic_password
severity = medium
line = 29
matchedText = ${L??""}...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L29dist/labels-BcNmRQMq.jsView file
496patternName = generic_password
severity = medium
line = 496
matchedText = password...rd",
Medium
Secret Pattern
Hardcoded password in dist/labels-BcNmRQMq.js
dist/labels-BcNmRQMq.jsFindings
12 Medium4 Low
MediumSecret Patterndist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/labels-BcNmRQMq.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/VenueCalendar-DPP0DBVa.js
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.115.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.115 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.