registry / @tscircuit/runframe / 0.0.3075
@tscircuit/runframe@0.0.3075
[tscircuit](https://github.com/tscircuit/tscircuit) ⋅ [View Examples](https://runframe.vercel.app)
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe critical scanner hint resolves to an intentional registry sign-in flow, and the captured telemetry fields are limited to UI activity and an anonymous identifier or embed domain. The inspected manifest has no install hook, and no concrete malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts registry sign-in or loads the browser component; telemetry can be disabled and is suppressed on localhost by default.
Impact
No credential theft, unrelated account action, install-time mutation, or other confirmed attack surface was found.
Mechanism
Sign-in exchanges a login-page token with the configured registry API and updates the registry session. Telemetry records UI component, tab, embed-domain, and anonymous-identifier fields.
AI rationale
The critical scanner hint resolves to an intentional registry sign-in flow, and the captured telemetry fields are limited to UI activity and an anonymous identifier or embed domain. The inspected manifest has no install hook, and no concrete malicious behavior was identified.
Evidence
package.jsondist/runner.jsdist/chunk-KMOEPKMO.js
Network endpoints2
registry-api.tscircuit.compostpig.tscircuit.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports browser preview and runner modules and has no install lifecycle hook.
- Login is initiated by the sign-in handler; its token exchange uses the configured TSCircuit registry API and then updates the registry session.
- Telemetry is browser-only, can be disabled, and skips localhost by default; captured fields are UI activity and an anonymous ID or embed domain.
- The reviewed dependency entrypoints and manifests correspond to the package’s circuit, worker-evaluation, and debugging dependencies.
Evidence against
Behavioral surface
DynamicRequireNetwork
HighEntropyStringsMinifiedUrlStrings
GitDependencyNoLicenseWildcardDependency
Source & flagged code
4 flaggeddist/chunk-KMOEPKMO.jsView file
•Browser cookie sent to a fixed external endpoint in dist/chunk-KMOEPKMO.js:
const registryApiBaseUrl = getWindowVar("TSCIRCUIT_REGISTRY_API_BASE_URL") || import.meta.env.VITE_TSCIRCUIT_REGISTRY_API_BASE_URL || "https://registry-api.tscircuit.com";
post: (url, options) => getRegistryKy().post(url, options),
var POSTHOG_API_HOST = "https://postpig.tscircuit.com";
return `https://tscircuit.com/editor?${typeParam}#data:application/gzip;base64,${base64Data}`;
const issueUrl = `https://github.com/tscircuit/tscircuit.com/issues/new?title=${encodeURIComponent(
"Initialize a tscircuit project using [tsci init](https://github.com/tscircuit/cli) before adding components.",
"Define reusable modules with cached routes using [<subcircuit />](https://docs.tscircuit.com/elements/subcircuit)",
"Quickly set
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-KMOEPKMO.jsView on unpkg3725if (!easyedaBrowserPromise) {
L3726: easyedaBrowserPromise = import(
L3727: /* @vite-ignore */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-KMOEPKMO.jsView on unpkg · L3725Findings
1 Critical6 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-KMOEPKMO.js
MediumDynamic Requiredist/chunk-KMOEPKMO.js
MediumNetwork
MediumOversized Source Filedist/standalone.min.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumWildcard Dependency
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @tscircuit/runframe@0.0.3075.
See all versions of @tscircuit/runframe for other recorded verdicts.
- Review the evidence and your use of @tscircuit/runframe@0.0.3075 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.