registry / @getmicdrop/venue-calendar / 4.1.11
@getmicdrop/venue-calendar@4.1.11
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is a bundled Svelte venue-calendar component with expected user-triggered API and checkout behavior. The scanner signals map to normal network/storage use and bundled artifacts, not a malicious chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Consumer renders the calendar or a user performs checkout.
Impact
Normal component data loading, ticket ordering, and limited attribution.
Mechanism
Package-aligned event and checkout API requests.
AI rationale
The package is a bundled Svelte venue-calendar component with expected user-triggered API and checkout behavior. The scanner signals map to normal network/storage use and bundled artifacts, not a malicious chain.
Evidence
package.jsondist/venue-calendar.es.jsdist/api/api.mjsdist/VenueCalendar-N_bwTYb2.js
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- dist/api/api.mjs uses the package-aligned get-micdrop.com API for calendar, orders, and checkout.
- Attribution is limited to generated IDs, UTM fields, and referrer during user checkout actions.
- No eval, child-process, filesystem, credential-harvesting, or agent-control code found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
13 flaggeddist/VenueCalendar-N_bwTYb2.jsView file
13861patternName = generic_password
severity = medium
line = 13861
matchedText = return c...1 };
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/VenueCalendar-N_bwTYb2.jsView on unpkg · L13861dist/venue-calendar.umd.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getmicdrop/venue-calendar@4.0.139
matchedIdentity = npm:[redacted]:4.0.139
similarity = 0.429
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/venue-calendar.umd.jsView on unpkg84patternName = generic_password
severity = medium
line = 84
matchedText = `&&c()}r...ne">
Findings
1 High15 Medium4 Low
HighPrevious Version Dangerous Deltadist/venue-calendar.umd.js
MediumSecret Patterndist/VenueCalendar-N_bwTYb2.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/index-B4k6GTMU.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.11.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.