tscircuit@0.0.2995
⚠ Under reviewMake electronics using Typescript, React, and AI tools. Just prompt your agent to "use tscircuit" and 10x its PCB capabilities!
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected source does not establish malicious behavior, but selected runtime dependencies remain unresolved. Manual review is warranted to assess those dependency entrypoints before clearing the package.
Static reason
No blocking static signals were detected.
Trigger
Importing the package or invoking its CLI reaches the unresolved dependencies.
Impact
The unresolved runtime code prevents a complete assessment of package behavior.
Mechanism
The main entrypoint imports core and eval, and the CLI imports the CLI package; their source could not be reviewed from this snapshot.
AI rationale
The inspected source does not establish malicious behavior, but selected runtime dependencies remain unresolved. Manual review is warranted to assess those dependency entrypoints before clearing the package.
Evidence
package.jsondist/index.jscli.mjs
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest shows no install lifecycle hook; the CLI entrypoint sets a bundled asset path and imports the CLI package when invoked.
- The main export delegates to @tscircuit/core and @tscircuit/eval, whose registry source was unresolved in the supplied snapshot.
- The inspected props bundle contains schema definitions, and the inspected React entry selects its development or production module.
Evidence against
- No concrete attack behavior was confirmed in the inspected package entrypoints or available dependency source.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
Source & flagged code
6 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18204259
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/ind
Low
Suspicious Lifecycle Evidence
The manifest shows no install lifecycle hook; the CLI entrypoint sets a bundled asset path and imports the CLI package when invoked.
package.jsonView on unpkg · L1756"@tscircuit/checks": "^0.0.261",
"@tscircuit/circuit-json-util": "^0.0.123",
"@tscircuit/cli": "^0.1.2394",
"@tscircuit/copper-pour-solver": "^0.0.67",
"@tscircuit/core": "^0.0.2191",
"@tscircuit/create-fdm-enclosure": "0.0.4",
"@tscircuit/ev
Findings
3 Medium9 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencepackage.json
LowAi Review Evidencecli.mjs
LowAi Review Evidencedist/index.js
LowAi Review Evidence.lpm-dependency-evidence-4814d511-94e6-443b-a9d5-0dfe61584e0a/3/npm-linux/package.json
Affected versions and remediation
This report applies to tscircuit@0.0.2995.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.2995 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.