registry / @getmicdrop/venue-calendar / 4.0.97
@getmicdrop/venue-calendar@4.0.97
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe inspected package is a browser calendar and ticketing widget with package-aligned MicDrop API, Stripe, and optional Meta analytics behavior. No install-time attack, payload execution, credential harvesting, or persistence mechanism was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing/mounting the calendar or initiating checkout in a browser.
Impact
Expected event-ticketing data and user interactions are sent to the configured MicDrop service and optional third-party providers.
Mechanism
Public event API, checkout, payment, and configured analytics requests.
AI rationale
The inspected package is a browser calendar and ticketing widget with package-aligned MicDrop API, Stripe, and optional Meta analytics behavior. No install-time attack, payload execution, credential harvesting, or persistence mechanism was found.
Evidence
package.jsondist/api/api.mjsdist/CartView-C3CM_of4.jsdist/VenueCalendar-ZIexgvtu.jsdist/Checkout-DlwrJNFl.jssrc/lib/theme.jsREADME.md
Network endpoints3
get-micdrop.comjs.stripe.comconnect.facebook.net/en_US/fbevents.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Browser bundle sends event/purchase analytics and can load Meta Pixel.
- Checkout dynamically loads Stripe.js for payment UI.
Evidence against
- package.json has no install/preinstall/postinstall hook; prepare target scripts/prepare.js is absent.
- dist/api/api.mjs uses configured MicDrop public API endpoints for calendar, cart, and orders.
- Analytics code is browser runtime tracking tied to widget actions, not credential or host-file harvesting.
- No child-process, filesystem, eval, native-loader, or AI-agent-control code found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/VenueCalendar-ZIexgvtu.jsView file
12055patternName = generic_password
severity = medium
line = 12055
matchedText = return H...1 };
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/VenueCalendar-ZIexgvtu.jsView on unpkg · L12055dist/venue-calendar.umd.jsView file
15patternName = generic_password
severity = medium
line = 15
matchedText = `&&g()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L1527patternName = generic_password
severity = medium
line = 27
matchedText = ${Z??""}...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
Findings
12 Medium4 Low
MediumSecret Patterndist/VenueCalendar-ZIexgvtu.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/labels-CGPu9d2k.js
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.0.97.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.0.97 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.