registry / @getmicdrop/venue-calendar / 4.1.21
@getmicdrop/venue-calendar@4.1.21
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is a browser calendar/checkout widget with package-aligned API, analytics, and Stripe integration. Its declared prepare script is missing from the published package, and inspection found no malicious execution or exfiltration chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing/mounting the calendar widget or using its checkout flows.
Impact
Sends intended widget/checkout requests; no credential harvesting, persistence, or destructive behavior found.
Mechanism
Browser calendar API, analytics, and payment integration.
AI rationale
The package is a browser calendar/checkout widget with package-aligned API, analytics, and Stripe integration. Its declared prepare script is missing from the published package, and inspection found no malicious execution or exfiltration chain.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-nR43Iptv.jsdist/Checkout-CMcAetKf.jsdist/CartView-BT6tT85K.jssrc/lib/theme.js
Network endpoints2
get-micdrop.comjs.stripe.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime analytics POST includes referrer, page URL, and generated IDs in dist/VenueCalendar-nR43Iptv.js.
- Checkout bundle loads Stripe.js from js.stripe.com.
Evidence against
- package.json's prepare target scripts/prepare.js is absent, so no packaged install-time code runs.
- No eval, Function, child_process, or filesystem-harvesting primitive found in published dist JS.
- API client defaults to the package-aligned get-micdrop.com endpoint.
- Tracking and payment requests are browser widget/checkout functionality.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/VenueCalendar-nR43Iptv.jsView file
13861patternName = generic_password
severity = medium
line = 13861
matchedText = return c...1 };
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/VenueCalendar-nR43Iptv.jsView on unpkg · L13861dist/venue-calendar.umd.jsView file
84patternName = generic_password
severity = medium
line = 84
matchedText = `&&c()}r...ne">
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L8493patternName = generic_password
severity = medium
line = 93
matchedText = }`}funct..."} ·
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
Findings
15 Medium4 Low
MediumSecret Patterndist/VenueCalendar-nR43Iptv.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/index-DkmP5LMr.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
Medium
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.21.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.