tscircuit@0.0.3018
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package declares no install hook, and its library entry point only re-exports tscircuit APIs. The CLI’s environment change selects the package’s own browser bundle for its delegated CLI; no malicious behavior was identified in the inspected source.
Static reason
No blocking static signals were detected.
Trigger
Importing the library exposes circuit APIs; running tsci starts the delegated CLI.
Impact
No malicious collection, credential use, unrelated account action, or destructive behavior was identified.
Mechanism
The library entry point re-exports core and evaluation APIs. The CLI sets a package-specific bundle path if unset and imports @tscircuit/cli.
AI rationale
The package declares no install hook, and its library entry point only re-exports tscircuit APIs. The CLI’s environment change selects the package’s own browser bundle for its delegated CLI; no malicious behavior was identified in the inspected source.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has build, test, and maintenance scripts but declares no install lifecycle hook.
- The CLI sets a package-specific bundle path only when the user has not already set one, then imports the tscircuit CLI.
- The library entry point re-exports tscircuit core and evaluation APIs; it contains no direct startup behavior.
Evidence against
- The CLI delegates command behavior to the added @tscircuit/cli dependency, whose source was unavailable for this review.
- The inspected dependencies include network fetches for circuit assets and services used by the package’s design and evaluation features.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
Source & flagged code
4 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18241615
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/ind
Low
Suspicious Lifecycle Evidence
The manifest has build, test, and maintenance scripts but declares no install lifecycle hook.
package.jsonView on unpkg · L17cli.mjsView file
Findings
3 Medium7 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencecli.mjs
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to tscircuit@0.0.3018.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3018 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.