registry / @getmicdrop/venue-calendar / 4.1.18
@getmicdrop/venue-calendar@4.1.18
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is a browser calendar/checkout component with package-aligned MicDrop API, Stripe, and configured analytics behavior. Static hints stem from those normal runtime features; no malicious install-time or runtime chain was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing/mounting the calendar or invoking checkout/widget features.
Impact
The mounted widget sends normal event/payment requests and telemetry; no credential harvesting, persistence, or remote code execution was found.
Mechanism
Calendar API, payment, attribution, and optional analytics requests.
AI rationale
The package is a browser calendar/checkout component with package-aligned MicDrop API, Stripe, and configured analytics behavior. Static hints stem from those normal runtime features; no malicious install-time or runtime chain was found.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-Btd-A22v.jsdist/utm-DZYMgFw9.jsdist/CartView-C1bvifmq.jsdist/Checkout-CuvEdrca.jsREADME.md
Network endpoints5
get-micdrop.comget-micdrop.com/api/v2/public/tax-previewconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=js.stripe.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime tracking posts page/referrer and widget IDs to MicDrop.
- Configured analytics can load Meta and Google tag scripts.
Evidence against
- No published preinstall/install/postinstall hook.
- Published prepare target scripts/prepare.js is absent; no install payload is present.
- No child-process, eval, Function, native, or binary-loading behavior found.
- Network code implements the documented calendar, checkout, and API client.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/index-CfjW0X1-.jsView file
521patternName = generic_password
severity = medium
line = 521
matchedText = password...ña",
Medium
dist/venue-calendar.umd.jsView file
84patternName = generic_password
severity = medium
line = 84
matchedText = `&&c()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L8493patternName = generic_password
severity = medium
line = 93
matchedText = }`}funct..."} ·
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsFindings
15 Medium4 Low
MediumSecret Patterndist/index-CfjW0X1-.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Pattern
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.18.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.