@tanstack/router-cli@1.167.21

One or more suspicious static signals were detected.

Explicit user invocation of tsr generate or tsr watch.

Expected project route generation may read configured routes and write generator outputs through its declared dependency; no exfiltration or persistence is present in this package source.

Route-generator delegation and chokidar-based file watching.

The suspicious hints correspond to a normal CLI entrypoint and its declared route-generator dependency. Direct inspection found no install-time execution or concrete malicious behavior.