tscircuit@0.0.3037
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s import entry exposes circuit-design and evaluation functionality, and its CLI wrapper runs the CLI when invoked. No lifecycle hooks or unrelated default actions were found; the observed bundled network calls are to tscircuit routing services.
Static reason
No blocking static signals were detected.
Trigger
Importing the library loads its entry point; the CLI wrapper runs when the tsci or tscircuit command is invoked.
Impact
No malicious or unrelated default behavior was identified in the inspected source.
Mechanism
The entry point re-exports core and evaluation APIs. The CLI wrapper configures a bundled file path and imports @tscircuit/cli. Bundled solver code contacts tscircuit service endpoints for routing.
AI rationale
The package’s import entry exposes circuit-design and evaluation functionality, and its CLI wrapper runs the CLI when invoked. No lifecycle hooks or unrelated default actions were found; the observed bundled network calls are to tscircuit routing services.
Network endpoints2
hd-cache2.tscircuit.comregistry-api.tscircuit.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The npm scripts define build and maintenance tasks, with no preinstall, install or postinstall hook.
- The package import entry re-exports tscircuit core and evaluation functionality.
- The CLI wrapper sets a path to the package’s bundled browser file and imports the CLI when the command runs.
Evidence against
- The manifest’s exports point to the library entry and browser bundle.
- Bundled solver code uses tscircuit service endpoints for routing, consistent with the circuit-design purpose.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/browser.min.js
Source & flagged code
5 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18867178
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
Low
Suspicious Lifecycle Evidence
The npm scripts define build and maintenance tasks, with no preinstall, install or postinstall hook.
package.jsonView on unpkg · L17dist/index.jsView file
1
Findings
3 Medium8 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
LowAi Review Evidencecli.mjs
Affected versions and remediation
This report applies to tscircuit@0.0.3037.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3037 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.