tscircuit@0.0.3036
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package exposes circuit-design APIs and a CLI, with no install lifecycle hook or suspicious behavior in the inspected entry points. The CLI delegates to @tscircuit/cli, but that dependency’s source was unavailable in the provided snapshot.
Static reason
No blocking static signals were detected.
Trigger
Library import or explicit invocation of the tsci/tscircuit command; no malicious trigger identified.
Impact
No malicious impact identified.
Mechanism
The library exports circuit-design APIs; the CLI configures the packaged bundle path and delegates to its CLI dependency.
AI rationale
The package exposes circuit-design APIs and a CLI, with no install lifecycle hook or suspicious behavior in the inspected entry points. The CLI delegates to @tscircuit/cli, but that dependency’s source was unavailable in the provided snapshot.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has build and test scripts but no install lifecycle hook.
- The library entry point re-exports circuit-design APIs from @tscircuit/core and @tscircuit/eval.
- The CLI sets a path to the packaged browser bundle when needed, then imports @tscircuit/cli when the command runs.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/browser.min.js51.6 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStringsgithub.com
Source & flagged code
5 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18861523
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/index.d.ts.tmp && mv dist/index.d.ts.tmp di
Low
Suspicious Lifecycle Evidence
The package has build and test scripts but no install lifecycle hook.
package.jsonView on unpkg · L1726"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./browser": "./dist/browser.min.js"
},
"bin": {
"tsci": "cli.mjs",
"tscircuit": "cli.mjs"
},
"devDependencies": {
"@types/bun": "^1.2.16",
"esbuild
Findings
3 Medium8 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to tscircuit@0.0.3036.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3036 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.