registry / @getmicdrop/venue-calendar / 4.0.118
@getmicdrop/venue-calendar@4.0.118
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe distributed code implements a MicDrop Svelte venue-calendar and ticketing client. Scanner signals map to normal runtime API, attribution, and optional analytics behavior; no malicious install-time or hidden execution chain was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A host page imports or mounts the calendar; analytics pixels require configured IDs.
Impact
The widget sends user-entered checkout/waitlist data and attribution data to MicDrop services as part of its advertised ticketing functionality.
Mechanism
Browser API calls, first-party telemetry, and optional marketing-pixel script injection.
AI rationale
The distributed code implements a MicDrop Svelte venue-calendar and ticketing client. Scanner signals map to normal runtime API, attribution, and optional analytics behavior; no malicious install-time or hidden execution chain was found.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-kbk6Pv_G.jsdist/venue-calendar.es.js
Network endpoints3
get-micdrop.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime tracking posts page, referrer, UTM, session and visitor IDs to the MicDrop API.
- Optional configured pixels load Meta and Google analytics scripts.
Evidence against
- package.json has no preinstall/install/postinstall hook.
- The declared prepare target scripts/prepare.js is absent from the package.
- Entrypoints are Svelte calendar, API, and SEO bundles.
- API base URL is get-micdrop.com and requests implement calendar, cart, checkout, and waitlist actions.
- No child-process, eval/vm, filesystem harvesting, agent-config writes, or binary loading found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
10 flaggeddist/VenueCalendar-kbk6Pv_G.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getmicdrop/venue-calendar@4.0.117
matchedIdentity = npm:[redacted]:4.0.117
similarity = 0.788
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/VenueCalendar-kbk6Pv_G.jsView on unpkg13041patternName = generic_password
severity = medium
line = 13041
matchedText = return s...1 };
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/VenueCalendar-kbk6Pv_G.jsView on unpkg · L13041dist/venue-calendar.umd.jsView file
17patternName = generic_password
severity = medium
line = 17
matchedText = `&&f()}r...ne">
Findings
1 High12 Medium4 Low
HighPrevious Version Dangerous Deltadist/VenueCalendar-kbk6Pv_G.js
MediumSecret Patterndist/VenueCalendar-kbk6Pv_G.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/labels-CMq-W2M3.js
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.118.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.118 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.