registry / @getmicdrop/venue-calendar / 4.0.127
@getmicdrop/venue-calendar@4.0.127
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiShipped code is an event-calendar/ticketing widget with package-aligned API, payment, attribution, and opt-in analytics behavior. The scanner signals reflect normal browser networking and bundled UI code; no concrete malicious chain was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Importing and using the calendar; checkout/tracking actions or explicit pixel configuration.
Impact
Normal ticketing and analytics data transmission; no credential harvesting, persistence, or install-time mutation found.
Mechanism
Fetches MicDrop ticketing APIs and conditionally injects configured analytics scripts.
AI rationale
Shipped code is an event-calendar/ticketing widget with package-aligned API, payment, attribution, and opt-in analytics behavior. The scanner signals reflect normal browser networking and bundled UI code; no concrete malicious chain was found.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-Z3o1Q_1m.jsdist/Checkout-D3mmS4cy.jsdist/seo/seo.mjssrc/lib/theme.js
Network endpoints3
get-micdrop.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/VenueCalendar-Z3o1Q_1m.js conditionally loads Meta/Google analytics when caller supplies pixel IDs.
- dist/api/api.mjs sends event, cart, and attribution data to the MicDrop public API during widget use.
Evidence against
- package.json has no preinstall/install/postinstall hooks; prepare references absent scripts/prepare.js.
- No child-process, filesystem-write, eval, or arbitrary remote-code loader found in shipped source.
- Dynamic imports in dist/VenueCalendar-Z3o1Q_1m.js are fixed local UI chunks.
- Analytics defaults have null pixel IDs; third-party scripts require explicit runtime configuration.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
10 flaggeddist/labels-C7WvkYI1.jsView file
526patternName = generic_password
severity = medium
line = 526
matchedText = password...rd",
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/labels-C7WvkYI1.jsView on unpkg · L526dist/VenueCalendar-Z3o1Q_1m.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getmicdrop/venue-calendar@4.0.125
matchedIdentity = npm:[redacted]:4.0.125
similarity = 0.576
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/VenueCalendar-Z3o1Q_1m.jsView on unpkg13078patternName = generic_password
severity = medium
line = 13078
matchedText = return d...1 };
Findings
1 High12 Medium4 Low
HighPrevious Version Dangerous Deltadist/VenueCalendar-Z3o1Q_1m.js
MediumSecret Patterndist/labels-C7WvkYI1.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/VenueCalendar-Z3o1Q_1m.js
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.127.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.127 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.