registry / @getmicdrop/venue-calendar / 4.1.49
@getmicdrop/venue-calendar@4.1.49
A customizable Svelte calendar component for displaying comedy events
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/venue-calendar.iife.js2.05 MB file, sampled 256 KB
NetworkHighEntropyStringsMinifiedUrlStringscalendar.google.comget-micdrop.comoutlook.live.comwww.google.comwww.w3.org
dist/venue-calendar.umd.js2.05 MB file, sampled 256 KB
Source & flagged code
7 flaggeddist/VenueCalendar-Sljpn5iv.jsView file
15249patternName = generic_password
severity = medium
line = 15249
matchedText = return P...1 };
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/VenueCalendar-Sljpn5iv.jsView on unpkg · L15249dist/venue-calendar.umd.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getmicdrop/venue-calendar@4.1.42
matchedIdentity = npm:[redacted]:4.1.42
similarity = 0.617
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/venue-calendar.umd.jsView on unpkgdist/index-B6S6bmug.jsView file
Findings
1 High9 Medium4 Low
HighPrevious Version Dangerous Deltadist/venue-calendar.umd.js
MediumSecret Patterndist/VenueCalendar-Sljpn5iv.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/index-B6S6bmug.js
MediumSecret Patterndist/api/api.cjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/api/api.mjs
MediumSecret Patterndist/labels-BhvPsg7u.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.49.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.