tscircuit@0.0.3048
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe browser bundle automatically sends usage telemetry to the package vendor and may include the embedding domain as an identifying detail. This merits a warning under the runtime telemetry rules; no malicious credential theft or unrelated collection was identified.
Static reason
No blocking static signals were detected.
Trigger
Loading the ./browser bundle in a browser, except on localhost or when TSCIRCUIT_TELEMETRY_DISABLED is enabled.
Impact
The vendor receives identifying domain or anonymous usage telemetry without an evident consent prompt.
Mechanism
The bundle initializes PostHog against https://postpig.tscircuit.com and captures runframe activity with the embedding domain or a persistent anonymous ID.
AI rationale
The browser bundle automatically sends usage telemetry to the package vendor and may include the embedding domain as an identifying detail. This merits a warning under the runtime telemetry rules; no malicious credential theft or unrelated collection was identified.
Evidence
dist/browser.min.js
Network endpoints1
postpig.tscircuit.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports dist/browser.min.js as its ./browser entry.
- The browser bundle initializes telemetry to postpig.tscircuit.com on load, unless telemetry is disabled or the host is localhost.
- Telemetry identifies the embedding domain or uses a persistent anonymous ID, and the bundle captures runframe activity.
Evidence against
- No install lifecycle scripts are declared.
- The main dist/index.js entry re-exports tscircuit libraries; the telemetry is in the separate browser bundle.
- No credential collection or unrelated data collector was identified.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
Source & flagged code
2 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 18999519
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
26"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./browser": "./dist/browser.min.js"
},
"bin": {
"tsci": "cli.mjs",
"tscircuit": "cli.mjs"
},
"devDependen
Medium
Ai Review Evidence
The package exports dist/browser.min.js as its ./browser entry.
package.jsonView on unpkg · L26Findings
4 Medium4 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tscircuit@0.0.3048.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3048 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.