tscircuit@0.0.3045
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe exported browser bundle enables runtime telemetry by default and sends browser activity and error details to the vendor’s analytics endpoint. Although it offers an opt-out and no credential theft or install-time collection was identified, the telemetry is not disclosed in the package README, so this warrants a warning.
Static reason
No blocking static signals were detected.
Trigger
Importing the browser bundle initializes telemetry; browser activity or runtime errors trigger event capture unless telemetry is disabled.
Impact
The vendor receives browser identity and usage or diagnostic details without disclosure found in the package README.
Mechanism
The bundle sends analytics events to https://postpig.tscircuit.com and includes an anonymous browser identifier, embed domain, activity details, and error messages or stacks.
AI rationale
The exported browser bundle enables runtime telemetry by default and sends browser activity and error details to the vendor’s analytics endpoint. Although it offers an opt-out and no credential theft or install-time collection was identified, the telemetry is not disclosed in the package README, so this warrants a warning.
Evidence
dist/browser.min.js
Network endpoints1
postpig.tscircuit.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The README describes tscircuit as an electronics design tool for describing circuit boards with TypeScript and React.
- The package exports `dist/browser.min.js` as its `./browser` entry point.
- The browser bundle initializes PostHog telemetry automatically at module evaluation, sending to `https://postpig.tscircuit.com`; telemetry can be disabled with `TSCIRCUIT_TELEMETRY_DISABLED`, and is suppressed on localhost by default.
- The bundle creates and stores an anonymous browser ID, derives an embed domain from the referrer or page hostname, and captures runframe activity and runtime error details, including stacks.
Evidence against
- The package declares no install lifecycle hook.
- The default Node entry point re-exports circuit APIs from `@tscircuit/core` and `@tscircuit/eval`.
- The telemetry destination is the package vendor’s own domain, and the bundle provides a telemetry opt-out.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
4 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18899533
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgREADME.mdView file
1# tscircuit - React for Circuits
**Design circuit boards with TypeScript and React.**
tscircuit is an open-source electronics design tool. Describe components a
Medium
Ai Review Evidence
The README describes tscircuit as an electronics design tool for describing circuit boards with TypeScript and React.
README.mdView on unpkg · L1package.jsonView file
26"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./browser": "./dist/browser.min.js"
},
"bin": {
"tsci": "cli.mjs",
"tscircuit": "cli.mjs"
},
"d
Findings
6 Medium4 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
MediumAi Review EvidenceREADME.md
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tscircuit@0.0.3045.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3045 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.