tscircuit@0.0.3041
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install hooks, and the library entry point re-exports the package’s stated circuit functionality. The CLI launcher configures the package’s own bundle and starts its declared CLI dependency; the reviewed source shows no concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
Library import or explicit invocation of the tsci/tscircuit CLI.
Impact
No malicious data collection, persistence, destructive behavior, or unauthorized account action was identified.
Mechanism
The library re-exports core and evaluation modules. The CLI points an environment variable at the package’s own browser bundle and imports @tscircuit/cli. Bundled solver network calls are part of circuit solving functionality.
AI rationale
The manifest has no install hooks, and the library entry point re-exports the package’s stated circuit functionality. The CLI launcher configures the package’s own bundle and starts its declared CLI dependency; the reviewed source shows no concrete malicious behavior.
Evidence
package.jsondist/browser.min.js
Network endpoints4
hd-cache.tscircuit.comhd-cache2.tscircuit.comregistry-api.tscircuit.commodelcdn.tscircuit.com
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library entry point and declares ordinary build and test scripts; no install lifecycle hook is present.
- The library entry point re-exports tscircuit core and evaluation functionality and exports React and footprint data.
- The CLI sets an environment variable to this package’s own browser bundle when needed, then imports the declared @tscircuit/cli dependency.
Evidence against
- The package provides a CLI and a large bundled webworker, but the inspected launcher does not show credential collection, unrelated file access, or hidden network behavior.
- Some CLI dependency source was unavailable for inspection; the package’s own launcher shows no suspicious action before importing it.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18892642
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
13"dist",
"cli.mjs",
"globals.d.ts"
],
"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\
Low
Suspicious Lifecycle Evidence
The manifest exposes a library entry point and declares ordinary build and test scripts; no install lifecycle hook is present.
package.jsonView on unpkg · L13dist/index.jsView file
Findings
3 Medium8 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowSuspicious Dependency Evidencecli.mjs
LowSuspicious Dependency Evidencecli.mjs
Affected versions and remediation
This report applies to tscircuit@0.0.3041.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3041 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.