registry / @tanstack/router-cli / 1.167.34
@tanstack/router-cli@1.167.34
Modern and scalable routing for React applications
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe scanner's dependency-bridge signal is explained by normal delegation to @tanstack/router-generator. Source inspection found no lifecycle execution, credential collection, network code, shell execution, or persistence.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the tsr generate or tsr watch command.
Impact
It may generate route artifacts in the user-selected project through its declared generator dependency.
Mechanism
Route generation and optional route-file watching.
AI rationale
The scanner's dependency-bridge signal is explained by normal delegation to @tanstack/router-generator. Source inspection found no lifecycle execution, credential collection, network code, shell execution, or persistence.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No install lifecycle hook is declared; scripts are development and build tasks.
- The CLI entry point only exposes explicit generate and watch commands.
- Generation delegates to the matching TanStack router generator dependency.
Evidence against
- The watch command monitors configured route files and regenerates output after the user starts it.
- README includes a passive tracking image, but package code does not request it.
Behavioral surface
Source & flagged code
5 flagged · loading sourcedist/cjs/generate.cjsView file
1package = @tanstack/router-cli; repositoryIdentity = router; dependency = @tanstack/router-generator
L1: let _tanstack_router_generator = require("@tanstack/router-generator");
L2: //#region src/generate.ts
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/cjs/generate.cjsView on unpkg · L11let _tanstack_router_generator = require("@tanstack/router-generator");
//#region src/generate.ts
async function generate(config, root) {
try {
await new _tanstack_router_generator.Generator({
config,
root
}).run();
process.exit(0);
} catch (err) {
console.error(err);
process.exit(1);
Low
Suspicious Dependency Evidence
Generation delegates to the matching TanStack router generator dependency.
dist/cjs/generate.cjsView on unpkg · L1package.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
Findings
2 High1 Medium4 Low
HighCopied Package Dependency Bridgedist/cjs/generate.cjs
HighSemantic Analysis Limitedpackage.json
MediumStructural Risk Force Deep Review
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cjs/index.cjs
LowSuspicious Dependency Evidencedist/cjs/generate.cjs
Affected versions and remediation
This report applies to @tanstack/router-cli@1.167.34.
See all versions of @tanstack/router-cli for other recorded verdicts.
- Review the evidence and your use of @tanstack/router-cli@1.167.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.