tscircuit@0.0.3065
**Design circuit boards with TypeScript and React.**
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe manifest declares no install lifecycle hook, and the library entry point exports the package’s circuit and evaluation APIs. The CLI’s environment-variable use is limited to selecting this package’s browser bundle before delegating to its CLI dependency; no attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Package installation, library import, or explicit invocation of the tsci/tscircuit CLI.
Impact
No malicious data collection, credential transfer, or unrelated account action was found in the inspected code.
Mechanism
The library entry re-exports circuit and evaluation APIs; the CLI configures a package bundle path and delegates to @tscircuit/cli.
AI rationale
The manifest declares no install lifecycle hook, and the library entry point exports the package’s circuit and evaluation APIs. The CLI’s environment-variable use is limited to selecting this package’s browser bundle before delegating to its CLI dependency; no attack behavior was identified.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has build and test scripts, with no install lifecycle hook.
- The package entry exports tscircuit core and evaluation functionality.
- The CLI sets a package-specific bundle path only when that environment variable is unset, then delegates to @tscircuit/cli.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/browser.min.js54.5 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStringsgithub.comreact.dev
Source & flagged code
4 flaggeddist/webworker.min.jsView file
•path = dist/webworker.min.js
kind = oversized_source_file
sizeBytes = 21061824
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/webworker.min.jsView on unpkgpackage.jsonView file
17"scripts": {
"build": "tsup-node && bun run copy-runframe-standalone && bun run copy-eval-webworker && cp types/static-assets.d.ts dist/static-assets.d.ts && bun run add-global-types-reference",
"add-global-types-reference": "echo '/// <reference path=\"../globals.d.ts\" />' | cat - dist/index.d.ts > dist/index.d.ts.tm
Low
Suspicious Lifecycle Evidence
The manifest has build and test scripts, with no install lifecycle hook.
package.jsonView on unpkg · L17dist/index.jsView file
Findings
3 Medium7 Low
MediumEnvironment Vars
MediumOversized Source Filedist/webworker.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli.mjs
Affected versions and remediation
This report applies to tscircuit@0.0.3065.
See all versions of tscircuit for other recorded verdicts.
- Review the evidence and your use of tscircuit@0.0.3065 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.