registry / @getmicdrop/venue-calendar / 4.0.124
@getmicdrop/venue-calendar@4.0.124
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection supports a normal MicDrop Svelte calendar and ticketing widget. Static network, environment, and secret-pattern signals map to configured public services and bundled UI assets, not a malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer imports or mounts the calendar widget; optional pixels require supplied widget configuration.
Impact
Normal event display, ticket checkout, and optional operator analytics; no credential or host-file exfiltration established.
Mechanism
Browser calendar/ticketing API calls with optional configured analytics and Stripe loading.
AI rationale
Source inspection supports a normal MicDrop Svelte calendar and ticketing widget. Static network, environment, and secret-pattern signals map to configured public services and bundled UI assets, not a malicious chain.
Evidence
package.jsondist/VenueCalendar-BVBxl8VZ.jsdist/api/api.mjssrc/lib/theme.jsdist/labels-BxfMxVrF.js
Network endpoints7
get-micdrop.com/api/v2/publicget-micdrop.com/api/orders/v2/publicconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=js.stripe.commoxy.sfo3.digitaloceanspaces.commoxy.sfo3.cdn.digitaloceanspaces.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json exposes a Svelte calendar and API/SEO/theme entrypoints only.
- The sole lifecycle hook, prepare, references scripts/prepare.js, which is absent from the packed files; no install-time payload is present.
- dist/VenueCalendar-BVBxl8VZ.js uses environment values only as public image-origin configuration.
- Runtime fetches target the package's MicDrop ticketing API for calendar, cart, checkout, and widget configuration.
- Facebook/Google pixels load only when runtime widget pixel configuration is supplied.
- No child-process, filesystem harvesting, eval/Function, AI-agent config access, or persistence behavior was found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/labels-BxfMxVrF.jsView file
496patternName = generic_password
severity = medium
line = 496
matchedText = password...rd",
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/labels-BxfMxVrF.jsView on unpkg · L496dist/VenueCalendar-BVBxl8VZ.jsView file
13041patternName = generic_password
severity = medium
line = 13041
matchedText = return s...1 };
Medium
Secret Pattern
Hardcoded password in dist/VenueCalendar-BVBxl8VZ.js
dist/VenueCalendar-BVBxl8VZ.jsView on unpkg · L13041dist/venue-calendar.umd.jsView file
Findings
12 Medium4 Low
MediumSecret Patterndist/labels-BxfMxVrF.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/VenueCalendar-BVBxl8VZ.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.124.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.124 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.