registry / @tanstack/router-cli / 1.167.31

@tanstack/router-cli@1.167.31

Modern and scalable routing for React applications

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. This is an explicit CLI for route generation and optional route-file watching; it declares no install hooks.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs tsr generate or tsr watch.

Impact

Expected project route-generation behavior only; no exfiltration, remote payload, persistence, or agent-control mutation was found.

Mechanism

invokes @tanstack/router-generator for the current project

Rationale

Direct inspection shows a conventional user-invoked route-generator CLI with a file watch mode. The scanner's dependency-bridge signal is the declared @tanstack/router-generator dependency, not a malicious chain.

Evidence

package.jsonbin/tsr.cjssrc/index.tssrc/generate.tssrc/watch.tsdist/cjs/index.cjsdist/cjs/generate.cjsdist/cjs/watch.cjs

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

No npm lifecycle hooks are declared.

@tanstack/router-cli@1.167.31

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code