@getmicdrop/venue-calendar@4.3.141
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package performs default runtime tracking to its first-party service, including visitor and page attribution data, while its documented consent control does not stop the event requests. This is a telemetry privacy risk rather than evidence of credential theft or unrelated malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An embedded calendar initializes and records its arrival or subsequent interactions.
Impact
MicDrop receives visitor activity and page attribution data; the consent control documented as holding tracking does not prevent the event posts.
Mechanism
The widget posts event data to the default MicDrop API endpoint /api/v2/public/track/pageview. Records include session, visitor and device identifiers, and can include the page URL and referrer.
AI rationale
The package performs default runtime tracking to its first-party service, including visitor and page attribution data, while its documented consent control does not stop the event requests. This is a telemetry privacy risk rather than evidence of credential theft or unrelated malicious behavior.
Evidence
dist/venue-calendar.es.jsdist/looks/4.3.141/first-core-DL0vBg_Y.jsREADME.md
Network endpoints1
get-micdrop.com/api/v2/public/track/pageview
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Calendar startup emits widget_load and link_click tracking events unless arrival tracking was already recorded.
- The runtime posts event records to MicDrop’s default API, including session, visitor and device IDs, plus referrer and page URL when its consent check permits those fields.
- The consent check controls those attribution fields, while the tracking POST itself still runs.
- The README says consent-required holds tracking until consent is granted, which does not match the unconditional tracking request.
Evidence against
- The beacons go to the package’s first-party service and track calendar interactions, which may support its venue analytics features.
- The README documents consent options and configurable API settings.
Behavioral surface
DynamicRequireEnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/id-PtzHP8eI.jsView file
45patternName = generic_password
severity = medium
line = 45
Medium
dist/venue-calendar.umd.jsView file
•Trigger-reachable chain: manifest.main -> dist/venue-calendar.umd.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/venue-calendar.umd.jsView on unpkg1(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("svelte/internal/disclose-version"),require("svelte/internal/client"),require("svelte/reactivity"),requ...
L2: transform: ${s} scale(${i+(1-i)*e});
Findings
3 Critical1 High8 Medium5 Low
CriticalTrojan Source Unicodedist/checkout-libs/4.3.141/phone.js
CriticalTrigger Reachable Dangerous Capabilitydist/venue-calendar.umd.js
CriticalPrevious Version Dangerous Deltadist/ImageUploader-CdyUevtP.js
HighSemantic Analysis Limiteddist/venue-calendar.css
MediumSecret Patterndist/id-PtzHP8eI.js
MediumDynamic Requiredist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/api-BO1PHZ57.js
MediumSecret Patterndist/de-BAUlpBbm.js
MediumSecret Patterndist/i18n-Bg5hEUrA.js
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.3.141.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.3.141 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.