tscircuit@0.0.3021
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install lifecycle hooks, and its entry points expose circuit-design functionality. The CLI wrapper sets a package asset path and loads the CLI; the inspected source does not show malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
Package installation, library import, or invocation of the tsci/tscircuit CLI.
Impact
No unauthorized data collection, account action, destructive behavior, or concealed code execution was found in the inspected source.
Mechanism
The package has no install lifecycle hooks; its library entry re-exports circuit tooling, and its CLI wrapper selects a bundled asset path before loading the CLI.
AI rationale
The package has no install lifecycle hooks, and its entry points expose circuit-design functionality. The CLI wrapper sets a package asset path and loads the CLI; the inspected source does not show malicious behavior.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install lifecycle hooks; its scripts are build, test, and dependency maintenance scripts.
- The package entry exports its library bundle and browser bundle, and maps its CLI commands to cli.mjs.
- cli.mjs sets a path to the package’s bundled browser asset only when the environment variable is unset, then imports @tscircuit/cli.
- dist/index.js re-exports @tscircuit/core and @tscircuit/eval and exposes React and circuit-related utilities.
- The inspected eval dependency resolves service base URLs from explicit options, environment overrides, or defaults.
Evidence against
- The CLI dependency source was unavailable for inspection, so its implementation could not be assessed.
- The browser and webworker bundles are large minified files; their broad content was not fully reviewed.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18241615
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/index.d.ts.tmp && mv dist/index.d.ts.tmp dist/index.d.ts",
"test": "bun test",
"upgrade-deps":
Low
Suspicious Lifecycle Evidence
package.json declares no install lifecycle hooks; its scripts are build, test, and dependency maintenance scripts.
package.jsonView on unpkg · L1726"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./browser": "./dist/browser.min.js"
},
"bin": {
"tsci": "cli.mjs",
"tscircuit":
Findings
3 Medium9 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencepackage.json
LowAi Review Evidencecli.mjs
LowAi Review Evidencedist/index.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-480e368e-1d37-4457-a31a-ecbeb39e5f09/2/npm-linux/dist/eval/index.js
Affected versions and remediation
This report applies to tscircuit@0.0.3021.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3021 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.