@tscircuit/runframe@0.0.3100
[tscircuit](https://github.com/tscircuit/tscircuit) ⋅ [View Examples](https://runframe.vercel.app)
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source shows runtime telemetry enabled by default, including embed-domain context and error messages or stacks; no user-facing disclosure was found in the inspected code. The credential and project-file flows appear tied to registry sign-in and bug-report submission, so the evidence supports a telemetry warning rather than malicious exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the browser bundle initializes telemetry; rendering preview components and encountering errors can send events.
Impact
The vendor receives usage context and error details. No automatic credential or project-file exfiltration was identified.
Mechanism
PostHog sends activity and error events, with an embed domain or persistent anonymous ID. A window flag disables telemetry.
AI rationale
The source shows runtime telemetry enabled by default, including embed-domain context and error messages or stacks; no user-facing disclosure was found in the inspected code. The credential and project-file flows appear tied to registry sign-in and bug-report submission, so the evidence supports a telemetry warning rather than malicious exfiltration.
Evidence
dist/chunk-GJNSZDJ7.jswindow.localStorage key runframe:anonymous-id
Network endpoints1
postpig.tscircuit.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The browser bundle initializes PostHog at module scope; telemetry can be disabled with a window flag, and localhost tracking is otherwise skipped.
- Telemetry is sent to https://postpig.tscircuit.com and identifies an embed domain or a persistent random anonymous ID.
- Rendered preview activity reports the component, embedding status, and active tab.
- Runtime error telemetry sends error messages and stacks unless the telemetry-disable flag is set.
- The bearer token flow uses the tscircuit registry API and begins in a sign-in handler.
Evidence against
- The inspected code does not show credentials or project files being sent to the telemetry endpoint.
- The project-file upload code is inside a bug-report confirmation handler, rather than an import-time upload.
Behavioral surface
DynamicRequireNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/chunk-GJNSZDJ7.jsView file
•Browser cookie sent to a fixed external endpoint in dist/chunk-GJNSZDJ7.js:
const registryApiBaseUrl = getWindowVar("TSCIRCUIT_REGISTRY_API_BASE_URL") || import.meta.env.VITE_TSCIRCUIT_REGISTRY_API_BASE_URL || "https://registry-api.tscircuit.com";
post: (url, options) => getRegistryKy().post(url, options),
var POSTHOG_API_HOST = "https://postpig.tscircuit.com";
return `https://tscircuit.com/editor?${typeParam}#data:application/gzip;base64,${base64Data}`;
const issueUrl = `https://github.com/tscircuit/tscircuit.com/issues/new?title=${encodeURIComponent(
"Initialize a tscircuit project using [tsci init](https://github.com/tscircuit/cli) before adding components.",
"Define reusable modules with cached routes using [<subcircuit />](https://docs.tscircuit.com/elements/subcircuit)",
"Quickly set
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/chunk-GJNSZDJ7.jsView on unpkg3810if (!easyedaBrowserPromise) {
L3811: easyedaBrowserPromise = import(
L3812: /* @vite-ignore */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-GJNSZDJ7.jsView on unpkg · L3810Findings
1 Critical7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/chunk-GJNSZDJ7.js
MediumDynamic Requiredist/chunk-GJNSZDJ7.js
MediumNetwork
MediumOversized Source Filedist/standalone.min.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumWildcard Dependency
MediumAi Review Evidencedist/chunk-GJNSZDJ7.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tscircuit/runframe@0.0.3100.
See all versions of @tscircuit/runframe for other recorded verdicts.
- Review the evidence and your use of @tscircuit/runframe@0.0.3100 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.