registry / @getmicdrop/venue-calendar / 4.3.142
@getmicdrop/venue-calendar@4.3.142
A customizable Svelte calendar component for displaying comedy events
AI Security Review
scanned 18h ago · by lpm-firewall-aiThe inspected source matches the package’s calendar and checkout purpose. The flagged phone file is a country calling-code dataset, and the API client uses the package’s own service host; no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Widget entry import registers the calendar element; API requests occur when calendar features call the client.
Impact
Expected calendar rendering and service requests; no malicious impact identified.
Mechanism
The client sends feature requests to its default service host, get-micdrop.com. The flagged phone file contains calling-code metadata.
AI rationale
The inspected source matches the package’s calendar and checkout purpose. The flagged phone file is a country calling-code dataset, and the API client uses the package’s own service host; no malicious behavior was identified.
Network endpoints1
get-micdrop.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Svelte calendar component and exposes calendar, API, SEO, and theme entry points.
- The API client defaults to get-micdrop.com and uses fetch for its API requests.
- The flagged phone.js file begins with country calling-code data, consistent with phone-number metadata.
Evidence against
- The entry registers the micdrop-calendar custom element and exposes configuration for the widget; this fits the package purpose.
- No credential collection, unrelated collector, or install-time network behavior was identified in the inspected source.
Behavioral surface
DynamicRequireEnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/it-DBUxtTKf.jsView file
45patternName = generic_password
severity = medium
line = 45
Medium
dist/venue-calendar.umd.jsView file
•Trigger-reachable chain: manifest.main -> dist/venue-calendar.umd.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/venue-calendar.umd.jsView on unpkg1(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("svelte/internal/disclose-version"),require("svelte/internal/client"),require("svelte/reactivity"),requ...
L2: transform: ${s} scale(${i+(1-i)*e});
Findings
2 Critical1 High6 Medium5 Low
CriticalTrojan Source Unicodedist/checkout-libs/4.3.142/phone.js
CriticalTrigger Reachable Dangerous Capabilitydist/venue-calendar.umd.js
HighSemantic Analysis Limiteddist/venue-calendar.css
MediumSecret Patterndist/it-DBUxtTKf.js
MediumDynamic Requiredist/venue-calendar.umd.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/fr-CWCM2N3F.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @getmicdrop/venue-calendar@4.3.142.
See all versions of @getmicdrop/venue-calendar for other recorded verdicts.
- Review the evidence and your use of @getmicdrop/venue-calendar@4.3.142 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.