registry / @getmicdrop/venue-calendar / 4.1.55
@getmicdrop/venue-calendar@4.1.55
A customizable Svelte calendar component for displaying comedy events
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/venue-calendar.iife.js2.20 MB file, sampled 256 KB
NetworkHighEntropyStringsMinifiedUrlStringswww.w3.org
dist/venue-calendar.umd.js2.16 MB file, sampled 256 KB
NetworkChildProcessEnvironmentVarsHighEntropyStrings
Source & flagged code
13 flaggeddist/es-DbimfZrw.jsView file
41patternName = generic_password
severity = medium
line = 41
matchedText = password...ña",
Medium
dist/venue-calendar.iife.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/venue-calendar.iife.jsView on unpkgdist/venue-calendar.umd.jsView file
Findings
2 High14 Medium4 Low
HighSemantic Analysis Limiteddist/venue-calendar.iife.js
HighPrevious Version Dangerous Deltadist/venue-calendar.umd.js
MediumSecret Patterndist/es-DbimfZrw.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/it-C3EqPWur.js
MediumSecret Patterndist/id-DDoD8R__.js
MediumSecret Patterndist/fr-COY3E_zw.js
MediumSecret Patterndist/de-DONA2y-J.js
MediumSecret Patterndist/labels-CCEO1mmp.js
MediumSecret Patterndist/nl-DZtRNZtx.js
MediumSecret Patterndist/api/api.cjs
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.1.55.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.1.55 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.