@tscircuit/runframe
[tscircuit](https://github.com/tscircuit/tscircuit) ⋅ [View Examples](https://runframe.vercel.app)
This report shows the evidence for @tscircuit/runframe@0.0.3144. 0 of 516 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe bundle enables runtime analytics by default and reports identifying embed-domain data and runtime errors to the package’s analytics host. The opt-out flag and localhost exclusion reduce the risk, but the collection is not disclosed in the inspected package metadata or code comments.
Decision evidence
public snapshot- The browser telemetry initializes by default unless a global disable flag is set; localhost is the only other default exclusion.
- Telemetry identifies the embed domain or a persistent anonymous ID and sends activity events to the configured PostHog host.
- Runtime error reporting sends error messages and stacks, which may include application-specific data.
- The package is a circuit preview and editing UI; its registry and file-server requests support those features.
- Telemetry can be disabled with TSCIRCUIT_TELEMETRY_DISABLED, and local development is excluded by default.
Source & flagged code
4 flaggedSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-SY7I2WMN.jsView on unpkgPackage source references dynamic require/import behavior.
dist/chunk-SY7I2WMN.jsView on unpkg · L3812Findings
Affected versions and remediation
This report applies to @tscircuit/runframe@0.0.3144.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @tscircuit/runframe@0.0.3144 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.