registry / @getmicdrop/venue-calendar / 4.3.139
@getmicdrop/venue-calendar@4.3.139
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged phone file contains phone-number metadata, while the reachable network and upload behavior supports the calendar widget. The package documents visitor consent for third-party pixels and exposes tracking controls; I found no concrete attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Import exposes the widget API; configuration fetches and upload callbacks occur when the widget is used.
Impact
No harmful impact identified.
Mechanism
The bundle loads calendar configuration from its API base, handles widget context, and delegates uploads to the host application's callback.
AI rationale
The flagged phone file contains phone-number metadata, while the reachable network and upload behavior supports the calendar widget. The package documents visitor consent for third-party pixels and exposes tracking controls; I found no concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Svelte calendar component and routes imports to its calendar bundles.
- The declared lifecycle scripts are prepare and prepublishOnly; no preinstall, install, or postinstall hook is declared.
- The flagged phone.js file begins with country calling code data.
- Runtime tracking uses widget and venue IDs; host page context is accepted only when the tracking predicate is true, and the README documents visitor consent for third-party pixels.
- The calendar fetches widget configuration through its API base, consistent with its purpose.
- The image uploader invokes an application-provided upload callback.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/de-vKpbo9Zl.jsView file
43patternName = generic_password
severity = medium
line = 43
Medium
dist/venue-calendar.umd.jsView file
•Trigger-reachable chain: manifest.main -> dist/venue-calendar.umd.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/venue-calendar.umd.jsView on unpkg1(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("svelte/internal/disclose-version"),require("svelte/internal/client"),require("svelte/reactivity"),requ...
L2: transform: ${s} scale(${i+(1-i)*e});
Findings
3 Critical1 High8 Medium4 Low
CriticalTrojan Source Unicodedist/checkout-libs/4.3.139/phone.js
CriticalTrigger Reachable Dangerous Capabilitydist/venue-calendar.umd.js
CriticalPrevious Version Dangerous Deltadist/ImageUploader-BzxKIyLN.js
HighSemantic Analysis Limiteddist/venue-calendar.css
MediumSecret Patterndist/de-vKpbo9Zl.js
MediumDynamic Requiredist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/id-_6GFAYBn.js
MediumSecret Patterndist/es-8qe0Mo-8.js
MediumSecret Patterndist/i18n-BNF6a-QA.js
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.3.139.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.3.139 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.