registry / @getmicdrop/venue-calendar / 4.0.120
@getmicdrop/venue-calendar@4.0.120
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection shows a Svelte venue-calendar and ticket-checkout package with fixed, vendor-aligned API calls. No install-time payload or concrete malicious chain was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders the calendar or a user performs ticket checkout.
Impact
Sends event/order and user-entered checkout data to MicDrop and Stripe as part of the advertised ticketing component.
Mechanism
Browser API requests and scoped checkout/attribution storage.
AI rationale
Direct inspection shows a Svelte venue-calendar and ticket-checkout package with fixed, vendor-aligned API calls. No install-time payload or concrete malicious chain was found.
Evidence
package.jsondist/api/api.mjsdist/utm-BJ4IBVeF.jsdist/CartView-rf1EqGf6.jsdist/labels-qimkvn4H.js
Network endpoints3
get-micdrop.com/api/v2/publicget-micdrop.com/api/orders/v2/publicjs.stripe.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall; prepare targets absent scripts/prepare.js.
- dist/api/api.mjs uses a fixed get-micdrop.com API base for calendar, cart, and order operations.
- dist/api/api.mjs attribution contains generated IDs, UTM fields, and referrer only for checkout/order requests.
- dist/utm-BJ4IBVeF.js persists checkout state and sends UTM tracking to the same vendor API.
- No child-process, eval/vm, file-system, binary-loading, or remote-code-loading behavior found in inspected files.
- dist/labels-qimkvn4H.js is compiled UI/label code; no secret or executable payload found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/labels-qimkvn4H.jsView file
496patternName = generic_password
severity = medium
line = 496
matchedText = password...rd",
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/labels-qimkvn4H.jsView on unpkg · L496dist/VenueCalendar-R-LToerx.jsView file
13041patternName = generic_password
severity = medium
line = 13041
matchedText = return s...1 };
Medium
Secret Pattern
Hardcoded password in dist/VenueCalendar-R-LToerx.js
dist/VenueCalendar-R-LToerx.jsView on unpkg · L13041dist/venue-calendar.umd.jsView file
Findings
12 Medium4 Low
MediumSecret Patterndist/labels-qimkvn4H.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/VenueCalendar-R-LToerx.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.120.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.120 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.