tscircuit@0.0.3027
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install hooks, its library entry point is a small set of API re-exports, and its CLI delegates to the tscircuit CLI dependency. The large bundled worker contains service requests consistent with circuit design; no unrelated malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Importing the library exposes its APIs; invoking tsci or tscircuit starts the CLI.
Impact
No malicious data collection, account action, or unrelated execution was identified.
Mechanism
The entry point re-exports circuit design dependencies. The CLI configures a bundled file path and imports @tscircuit/cli.
AI rationale
The package has no install hooks, its library entry point is a small set of API re-exports, and its CLI delegates to the tscircuit CLI dependency. The large bundled worker contains service requests consistent with circuit design; no unrelated malicious behavior was identified.
Network endpoints4
registry-api.tscircuit.comhd-cache.tscircuit.comhd-cache2.tscircuit.comapi.tscircuit.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point is dist/index.js, and package.json contains no install lifecycle scripts.
- dist/index.js only re-exports circuit design APIs from @tscircuit/core and @tscircuit/eval, plus React and props exports.
- The CLI sets an environment variable to the path of its bundled browser file when unset, then delegates to @tscircuit/cli.
Evidence against
- The package bundles large browser and worker artifacts, which limit easy inspection of every bundled code path.
- The worker includes requests to tscircuit services for circuit routing and cache functions, consistent with the package’s circuit-design purpose.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18241615
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
2"name": "tscircuit",
"main": "dist/index.js",
"types": "dist/index.d.ts",
"type": "module",
"version": "0.0.3027",
"license": "MIT",
"repository": {
"type": "git",
Low
Suspicious Lifecycle Evidence
The package entry point is dist/index.js, and package.json contains no install lifecycle scripts.
package.jsonView on unpkg · L217"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/index.d.
Findings
3 Medium9 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
LowAi Review Evidencecli.mjs
Affected versions and remediation
This report applies to tscircuit@0.0.3027.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3027 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.