registry / @getmicdrop/venue-calendar / 4.3.138
@getmicdrop/venue-calendar@4.3.138
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed entrypoint behavior and Unicode in the flagged phone helper are consistent with a calendar widget and phone-number normalization. Runtime configuration requests go to the package’s own service; no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import registers the widget element; configuration is fetched when a configured widget mounts.
Impact
No unauthorized collection, credential handling, account action, or unrelated execution was identified.
Mechanism
The widget fetches its configuration from the package service and loads calendar features. The flagged Unicode appears in phone-number separator data.
AI rationale
The reviewed entrypoint behavior and Unicode in the flagged phone helper are consistent with a calendar widget and phone-number normalization. Runtime configuration requests go to the package’s own service; no malicious behavior was identified.
Evidence
dist/venue-calendar.es.jsdist/api/api.mjsdist/checkout-libs/4.3.138/phone.jspackage.json
Network endpoints1
get-micdrop.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Svelte calendar component and points consumers to its built entrypoints.
- The flagged phone bundle includes zero-width and other Unicode spacing characters in a phone-number separator set, consistent with input normalization.
- Widget configuration is fetched only when a calendar element has a widget ID, then used to mount the component.
- The API client’s default host is the package’s own get-micdrop.com domain.
- The declared prepare and prepublishOnly scripts perform preparation and building; no install-time data collection was identified.
Evidence against
- The browser entrypoint registers a custom element and performs runtime network requests as part of the widget’s operation.
- A phone-number helper contains invisible Unicode spacing characters, but the inspected occurrence is in its separator character set.
Behavioral surface
DynamicRequireEnvironmentVarsNetwork
HighEntropyStrings
Source & flagged code
5 flaggeddist/venue-calendar.umd.jsView file
•Trigger-reachable chain: manifest.main -> dist/venue-calendar.umd.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/venue-calendar.umd.jsView on unpkg1(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("svelte/internal/disclose-version"),require("svelte/internal/client"),require("svelte/reactivity"),requ...
L2: transform: ${s} scale(${i+(1-i)*e});
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/venue-calendar.umd.jsView on unpkg · L1•path = dist/venue-calendar.umd.js
kind = oversized_source_file
sizeBytes = 5826588
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/venue-calendar.umd.jsFindings
2 Critical1 High5 Medium4 Low
CriticalTrojan Source Unicodedist/checkout-libs/4.3.138/phone.js
CriticalTrigger Reachable Dangerous Capabilitydist/venue-calendar.umd.js
HighSemantic Analysis Limiteddist/venue-calendar.css
MediumDynamic Requiredist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/venue-calendar.umd.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.3.138.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.3.138 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.