registry / @getmicdrop/venue-calendar / 4.0.139
@getmicdrop/venue-calendar@4.0.139
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection shows a browser calendar and ticketing component with product-aligned API, payment, and optional analytics integrations. No malicious install-time behavior, exfiltration chain, persistence, or host-control mutation was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer renders or uses the calendar/checkout widget.
Impact
Normal event-ticketing data exchange; no install-time host mutation or unconsented payload execution found.
Mechanism
Browser API requests and configured third-party SDK loading.
AI rationale
Source inspection shows a browser calendar and ticketing component with product-aligned API, payment, and optional analytics integrations. No malicious install-time behavior, exfiltration chain, persistence, or host-control mutation was found.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-BYLDom2P.jsdist/Checkout-B9gA1vPz.jssrc/lib/theme.jsdist/venue-calendar.es.js
Network endpoints4
get-micdrop.comjs.stripe.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/api/api.mjs sends calendar/cart/order requests to MicDrop public APIs at runtime.
- dist/VenueCalendar-BYLDom2P.js conditionally loads Meta/Google analytics when configured.
- dist/Checkout-B9gA1vPz.js loads Stripe.js for checkout.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The declared prepare target scripts/prepare.js is absent from the packed files.
- Entrypoints are browser Svelte bundles; no filesystem, shell, eval, or credential-harvesting behavior found.
- Analytics and payment endpoints are explicit, product-aligned browser integrations.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/venue-calendar.umd.jsView file
80patternName = generic_password
severity = medium
line = 80
matchedText = `&&c()}r...ne">
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/venue-calendar.umd.jsView on unpkg · L8089patternName = generic_password
severity = medium
line = 89
matchedText = }`}funct..."} ·
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L8992patternName = generic_password
severity = medium
line = 92
matchedText = ${z??""}...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L92dist/VenueCalendar-BYLDom2P.js
Findings
15 Medium4 Low
MediumSecret Patterndist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/VenueCalendar-BYLDom2P.js
MediumSecret Patterndist/index-CqkZyqzH.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
Medium
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.139.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.139 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.