tscircuit@0.0.3031
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package manifest and inspected entry points show no install hooks or suspicious import-time behavior. The visible network configuration belongs to tscircuit’s circuit evaluation services.
Static reason
No blocking static signals were detected.
Trigger
Importing the library loads its core and evaluator dependencies; invoking the CLI delegates to @tscircuit/cli.
Impact
No malicious impact was identified in the inspected source.
Mechanism
The inspected entry points re-export package functionality, and the evaluator is configured to use tscircuit service hosts.
AI rationale
The package manifest and inspected entry points show no install hooks or suspicious import-time behavior. The visible network configuration belongs to tscircuit’s circuit evaluation services.
Evidence
cli.mjs
Network endpoints2
registry-api.tscircuit.comcjs.tscircuit.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the library entry to dist/index.js and declares no install lifecycle scripts.
- dist/index.js re-exports the circuit core and evaluator; no additional top-level behavior is present in the entry file.
- The CLI wrapper sets a local standalone bundle path when needed, then delegates to @tscircuit/cli.
- The evaluator’s configured service URLs are tscircuit hosts, consistent with fetching circuit snippets and related data.
Evidence against
- The package includes a large minified webworker bundle, which is difficult to review linearly.
- The CLI dependency source was unresolved in the prepared dependency evidence.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18241615
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
1{
"name": "tscircuit",
"main": "dist/index.js",
"types": "dist/index.d.ts",
"type": "module",
"version": "0.0.3031",
"license": "MIT",
"repository": {
"type": "gi
Low
Suspicious Lifecycle Evidence
The manifest points the library entry to dist/index.js and declares no install lifecycle scripts.
package.jsonView on unpkg · L1dist/index.jsView file
1// index.ts
export * from "@tscircuit/core";
import { jscad } from "@tscircuit/core";
export * from "@tscircuit/eval";
import { Fragment } from "react";
import { kicadFootprintStr
Findings
3 Medium8 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
LowAi Review Evidence.lpm-dependency-evidence-d60f75e1-4390-43ba-b758-f21c1b47c4fb/2/npm-linux/dist/eval/index.js
Affected versions and remediation
This report applies to tscircuit@0.0.3031.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3031 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.