registry / @tanstack/router-cli / 1.167.29

@tanstack/router-cli@1.167.29

Modern and scalable routing for React applications

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked route-generation CLI and file watcher.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the tsr CLI generate or watch command.

Impact

Expected route-generation behavior only; no confirmed exfiltration, persistence, remote payload execution, or install-time action.

Mechanism

Parses CLI commands and delegates route generation to @tanstack/router-generator.

Rationale

Source inspection shows a conventional explicit CLI wrapper around the TanStack route generator and chokidar watcher. Scanner concerns stem from that dependency bridge and a dev-only wildcard dependency, neither of which establishes malicious behavior.

Evidence

package.jsonbin/tsr.cjssrc/index.tssrc/generate.tssrc/watch.ts

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

The CLI entrypoint only registers explicit generate and watch commands.
Generation delegates to the package-aligned @tanstack/router-generator dependency.

@tanstack/router-cli@1.167.29

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code