registry / @getmicdrop/venue-calendar / 4.0.125
@getmicdrop/venue-calendar@4.0.125
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection shows a browser calendar component with package-aligned Micdrop APIs and optional, configured analytics. No install-time execution, exfiltration of local credentials/files, remote payload execution, or persistence was found.
Static reason
One or more suspicious static signals were detected.
Trigger
User imports/mounts the calendar or adds its web component.
Impact
Normal event-calendar operation and optional marketing analytics; no malicious behavior established.
Mechanism
calendar API requests and configured analytics telemetry
AI rationale
Direct inspection shows a browser calendar component with package-aligned Micdrop APIs and optional, configured analytics. No install-time execution, exfiltration of local credentials/files, remote payload execution, or persistence was found.
Evidence
package.jsondist/VenueCalendar-jQ0Aqqfg.jsdist/api/api.mjsdist/labels-sHSRa0-J.jsREADME.mdsrc/lib/theme.js
Network endpoints4
get-micdrop.com/api/v2/publicget-micdrop.com/api/orders/v2/publicconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime bundle sends calendar/checkout telemetry including referrer and page URL.
- Optional configured pixels load Meta and Google analytics scripts.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- prepare references scripts/prepare.js, which is absent from this package.
- Entrypoints are Svelte calendar, API, and SEO bundles; no shell, eval, or filesystem-harvesting code found.
- Pixel loading requires supplied widget configuration and is consent-gated.
- The labels file's password/token terms are UI strings, not credentials.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/labels-sHSRa0-J.jsView file
496patternName = generic_password
severity = medium
line = 496
matchedText = password...rd",
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/labels-sHSRa0-J.jsView on unpkg · L496dist/venue-calendar.umd.jsView file
17patternName = generic_password
severity = medium
line = 17
matchedText = `&&g()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L1729patternName = generic_password
severity = medium
line = 29
matchedText = ${L??""}...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsFindings
12 Medium4 Low
MediumSecret Patterndist/labels-sHSRa0-J.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/VenueCalendar-jQ0Aqqfg.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.125.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.125 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.