tscircuit@0.0.3032
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe browser bundle automatically reports runtime and circuit errors, and the package README does not disclose this telemetry. The opt-out setting reduces the risk, so this is suspicious runtime telemetry rather than a blockable attack.
Static reason
No blocking static signals were detected.
Trigger
The UI renders an execution error or circuit JSON errors, unless telemetry is disabled through the global setting.
Impact
Runtime errors may be reported externally; the package provides a disable setting, but its README does not disclose the reporting.
Mechanism
The bundle creates Error objects from error messages and stacks and passes them to `Nq.captureException`.
AI rationale
The browser bundle automatically reports runtime and circuit errors, and the package README does not disclose this telemetry. The opt-out setting reduces the risk, so this is suspicious runtime telemetry rather than a blockable attack.
Evidence
dist/browser.min.jsREADME.md
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The browser bundle automatically reports execution errors and circuit JSON errors through `captureException`.
- Reporting is skipped only when `TSCIRCUIT_TELEMETRY_DISABLED` is exactly `true`.
- The package README describes the circuit-design tool but does not disclose this error reporting.
Evidence against
- The manifest declares no install, preinstall, or postinstall hook.
- The main entry re-exports circuit core and evaluation APIs.
- The CLI sets a standalone bundle path and imports the CLI package.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/browser.min.js
Source & flagged code
2 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18241615
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgREADME.mdView file
1# tscircuit - React for Circuits
**Design circuit boards with TypeScript and React.**
tscircuit is an open-source electronics design tool. Describe components and connections in code, preview your s
Medium
Ai Review Evidence
The package README describes the circuit-design tool but does not disclose this error reporting.
README.mdView on unpkg · L1Findings
4 Medium4 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
MediumAi Review EvidenceREADME.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tscircuit@0.0.3032.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3032 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.