tscircuit@0.0.2993
⚠ Under reviewMake electronics using Typescript, React, and AI tools. Just prompt your agent to "use tscircuit" and 10x its PCB capabilities!
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected manifest has no npm install lifecycle hook, and the available props and React sources show ordinary library behavior. The main and CLI entrypoints depend on unresolved registry packages, so static source evidence is insufficient to rule out risk across those paths.
Decision evidence
public snapshot- The manifest selects dist/index.js and declares build and maintenance scripts; no npm install lifecycle hook is declared.
- dist/index.js imports @tscircuit/core and @tscircuit/eval, whose runtime behavior could not be resolved from the available source.
- When invoked, cli.mjs dynamically imports @tscircuit/cli, whose source was not available for review.
- The available @tscircuit/props bundle contains component schemas and imports Zod and circuit-json.
- The available React entrypoint selects its bundled implementation according to NODE_ENV.
- No concrete attack behavior was identified in the inspected source files.
Source & flagged code
6 flaggedPackage contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgThe manifest selects dist/index.js and declares build and maintenance scripts; no npm install lifecycle hook is declared.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to tscircuit@0.0.2993.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.2993 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.