registry / @getmicdrop/venue-calendar / 4.0.119
@getmicdrop/venue-calendar@4.0.119
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe static signals map to a browser calendar/checkout widget with package-aligned APIs and configurable analytics, not an install-time or covert malicious chain. The declared prepare target is absent from the shipped package, and no malicious execution primitive was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Mounting the calendar or custom element in a browser.
Impact
Normal widget data and browsing attribution may be sent to its configured service providers; no credential or local-file exfiltration found.
Mechanism
Public API, checkout, attribution, and optional analytics requests.
AI rationale
The static signals map to a browser calendar/checkout widget with package-aligned APIs and configurable analytics, not an install-time or covert malicious chain. The declared prepare target is absent from the shipped package, and no malicious execution primitive was found.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-CTbK9apa.jsdist/venue-calendar.es.jsdist/labels-Bu2Awugs.js
Network endpoints4
get-micdrop.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=js.stripe.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime telemetry posts page and funnel events to MicDrop.
- Widget configuration can enable Meta and Google analytics loaders.
- The manifest names a prepare script, but scripts/prepare.js is absent.
Evidence against
- No install, preinstall, or postinstall hook is declared.
- Shipped entrypoints are a Svelte calendar, public API client, and SEO helper.
- Network use is tied to calendar, checkout, attribution, and optional operator pixels.
- No child-process, filesystem, eval/vm, native loading, or credential harvesting was found.
- labels-Bu2Awugs.js contains UI labels and event-password text, not a secret.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/labels-Bu2Awugs.jsView file
496patternName = generic_password
severity = medium
line = 496
matchedText = password...rd",
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/labels-Bu2Awugs.jsView on unpkg · L496dist/venue-calendar.umd.jsView file
17patternName = generic_password
severity = medium
line = 17
matchedText = `&&f()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L1729patternName = generic_password
severity = medium
line = 29
matchedText = ${L??""}...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsFindings
12 Medium4 Low
MediumSecret Patterndist/labels-Bu2Awugs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/VenueCalendar-CTbK9apa.js
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.119.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.119 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.