registry / @getmicdrop/venue-calendar / 4.1.19
@getmicdrop/venue-calendar@4.1.19
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe observed network and storage behavior is package-aligned calendar, ticketing, attribution, and configurable analytics functionality. Direct inspection found no execution, persistence, credential theft, or destructive chain indicating malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Calendar/widget use; optional pixels require configured measurement IDs.
Impact
Sends event/checkout and attribution data to the package service during normal widget use.
Mechanism
Browser API requests and configurable analytics pixel loading
AI rationale
The observed network and storage behavior is package-aligned calendar, ticketing, attribution, and configurable analytics functionality. Direct inspection found no execution, persistence, credential theft, or destructive chain indicating malware.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-IZHiz_Io.jsdist/utm-CwhRZxk-.jsREADME.md
Network endpoints3
get-micdrop.comconnect.facebook.net/en_US/fbevents.jswww.googletagmanager.com/gtag/js?id=
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Declared prepare targets absent scripts/prepare.js; no packaged lifecycle payload exists.
- dist/api/api.mjs implements Micdrop event, cart, and checkout API calls.
- dist/VenueCalendar-IZHiz_Io.js loads analytics pixels only when IDs are configured.
- No child-process, eval/Function, native loading, or filesystem-write behavior found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/VenueCalendar-IZHiz_Io.jsView file
13861patternName = generic_password
severity = medium
line = 13861
matchedText = return c...1 };
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/VenueCalendar-IZHiz_Io.jsView on unpkg · L13861dist/venue-calendar.umd.jsView file
84patternName = generic_password
severity = medium
line = 84
matchedText = `&&c()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L8493patternName = generic_password
severity = medium
line = 93
matchedText = }`}funct..."} ·
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
Findings
15 Medium4 Low
MediumSecret Patterndist/VenueCalendar-IZHiz_Io.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
Medium
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.19.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.