registry / @getmicdrop/venue-calendar / 4.1.22
@getmicdrop/venue-calendar@4.1.22
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe distributed code is a Svelte venue calendar and checkout widget with first-party API calls and a fixed Stripe SDK loader. The scanner signals are explained by legitimate browser networking, bundled checkout state, and a non-shipped prepare target.
Static reason
One or more suspicious static signals were detected.
Trigger
Widget import/mount and user calendar or checkout actions.
Impact
Expected event display, cart, and checkout behavior; no unconsented install-time mutation or exfiltration identified.
Mechanism
Browser UI fetches and payment integration.
AI rationale
The distributed code is a Svelte venue calendar and checkout widget with first-party API calls and a fixed Stripe SDK loader. The scanner signals are explained by legitimate browser networking, bundled checkout state, and a non-shipped prepare target.
Evidence
package.jsondist/api/api.mjsdist/VenueCalendar-C3872B6V.jsdist/Checkout-B2WFPv0O.jsREADME.mdsrc/lib/theme.js
Network endpoints2
get-micdrop.comjs.stripe.com/clover/stripe.js
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall hook.
- The prepare target scripts/prepare.js is absent from the packed files.
- dist/api/api.mjs uses the fixed first-party base URL https://get-micdrop.com.
- Fetches implement calendar, cart, order, promo, and UTM API operations.
- dist/Checkout-B2WFPv0O.js loads only https://js.stripe.com/clover/stripe.js.
- No child-process, filesystem harvesting, eval, or persistence code found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/venue-calendar.umd.jsView file
84patternName = generic_password
severity = medium
line = 84
matchedText = `&&c()}r...ne">
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/venue-calendar.umd.jsView on unpkg · L8493patternName = generic_password
severity = medium
line = 93
matchedText = }`}funct..."} ·
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L9397patternName = generic_password
severity = medium
line = 97
matchedText = ${e.get(...ghs.
Medium
Secret Pattern
Hardcoded password in dist/venue-calendar.umd.js
dist/venue-calendar.umd.jsView on unpkg · L97dist/index-BTUQvBzR.js
Findings
15 Medium4 Low
MediumSecret Patterndist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/venue-calendar.umd.js
MediumSecret Patterndist/index-BTUQvBzR.js
MediumSecret Patterndist/VenueCalendar-C3872B6V.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/venue-calendar.iife.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
Medium
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.22.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.