tscircuit@0.0.3042
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest declares no install lifecycle hook, and the package entrypoint and CLI wrapper perform expected circuit-library and CLI setup. The bundled worker's observed service references are consistent with routing and model features; no unrelated data collection or credential exfiltration was found.
Static reason
No blocking static signals were detected.
Trigger
Package import exposes circuit library functionality; invoking tsci or tscircuit starts the CLI; routing and model services are used when those features run.
Impact
No malicious impact identified; observed behavior supports circuit modeling, routing, and CLI use.
Mechanism
The entrypoint re-exports circuit modules, and the CLI configures the package's standalone bundle before importing its CLI dependency. The bundled worker references tscircuit service endpoints for routing and model assets; no unrelated collection or credential handling was identified.
AI rationale
The manifest declares no install lifecycle hook, and the package entrypoint and CLI wrapper perform expected circuit-library and CLI setup. The bundled worker's observed service references are consistent with routing and model features; no unrelated data collection or credential exfiltration was found.
Network endpoints4
hd-cache.tscircuit.comhd-cache2.tscircuit.comregistry-api.tscircuit.commodelcdn.tscircuit.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The declared npm scripts cover build, tests, and dependency maintenance; no install lifecycle script is declared.
- The package entrypoint re-exports circuit functionality from @tscircuit/core and @tscircuit/eval.
- The CLI sets a package-specific standalone bundle path and then imports @tscircuit/cli when the command runs.
- The bundled worker references tscircuit routing and model service endpoints consistent with circuit design features.
Evidence against
- The CLI dependency source was unresolved in the prepared dependency evidence, so its implementation was not inspected.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
Source & flagged code
6 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18892642
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/index.d.ts.tmp && mv dist/index.d.ts.tmp dist/index.d.ts",
"test": "bun test",
"upgrade-deps": "bun update --latest @tscircuit/core @tscircuit/cli @tscircuit/eval @tscircuit/r
Low
Suspicious Lifecycle Evidence
The declared npm scripts cover build, tests, and dependency maintenance; no install lifecycle script is declared.
package.jsonView on unpkg · L1726"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./browser": "./dist/browser.min.js"
},
"bin": {
"tsci": "cli.mjs",
"tscircuit": "cli.mjs"
},
"devDependencies": {
"@types/bun": "^1.2.16",
"esbuild": "^0.20.
Findings
3 Medium9 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
LowAi Review Evidencecli.mjs
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to tscircuit@0.0.3042.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3042 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.