tscircuit@0.0.3029
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest declares no install lifecycle hook, and the added CLI configures a bundled standalone file before loading the CLI package. The inspected entry points and bundled functionality align with circuit design and evaluation; no malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Importing the library or explicitly running the tsci/tscircuit binary.
Impact
No unauthorized data collection, credential access, or unrelated system changes were identified in the inspected source.
Mechanism
The library re-exports core and evaluation functionality. The CLI points its standalone-file environment variable at the included browser bundle when needed.
AI rationale
The manifest declares no install lifecycle hook, and the added CLI configures a bundled standalone file before loading the CLI package. The inspected entry points and bundled functionality align with circuit design and evaluation; no malicious behavior was found.
Evidence
dist/browser.min.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No install lifecycle hook is declared; package scripts shown are build and maintenance commands.
- The CLI sets TSCIRCUIT_GLOBAL_STANDALONE_FILE_PATH to the package’s bundled browser file only when the variable is unset.
- The main entry re-exports tscircuit core and evaluation functionality.
Evidence against
- The manifest exposes a library entry point, a browser bundle, and CLI commands consistent with the package’s circuit design purpose.
- The CLI imports @tscircuit/cli when the user runs its binary; its setup selects the bundled standalone file for that CLI.
- The bundled source includes expected circuit design and evaluation functionality; no malicious behavior was identified in the inspected entry points.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18241615
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-typ
Low
Suspicious Lifecycle Evidence
No install lifecycle hook is declared; package scripts shown are build and maintenance commands.
package.jsonView on unpkg · L17cli.mjsView file
16
Findings
3 Medium8 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencecli.mjs
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
Affected versions and remediation
This report applies to tscircuit@0.0.3029.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3029 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.