registry / @tanstack/router-cli / 1.167.36
@tanstack/router-cli@1.167.36
Modern and scalable routing for React applications
AI Security Review
scanned 1mo ago · by lpm-firewall-aiDirect inspection shows a small route-generator CLI without install hooks or malicious primitives. The scanner's dependency-bridge signal is explained by the declared @tanstack/router-generator dependency and direct wrapper call.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes tsr generate or tsr watch.
Impact
No credential collection, exfiltration, persistence, install-time execution, or remote payload behavior was identified.
Mechanism
Delegates route generation and file watching to declared dependencies.
AI rationale
Direct inspection shows a small route-generator CLI without install hooks or malicious primitives. The scanner's dependency-bridge signal is explained by the declared @tanstack/router-generator dependency and direct wrapper call.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a tsr command that loads its CLI entrypoint.
- The generator wrapper delegates route generation to @tanstack/router-generator.
- The watch command monitors configured route paths and reruns the generator.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- No package code performs network requests, reads environment secrets, launches child processes, or evaluates dynamic code.
- The reviewed command handlers are limited to explicit generate and watch operations.
Behavioral surface
Source & flagged code
6 flagged · loading sourcedist/cjs/generate.cjsView file
1package = @tanstack/router-cli; repositoryIdentity = router; dependency = @tanstack/router-generator
L1: let _tanstack_router_generator = require("@tanstack/router-generator");
L2: //#region src/generate.ts
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/cjs/generate.cjsView on unpkg · L13async function generate(config, root) {
try {
await new _tanstack_router_generator.Generator({
config,
root
}).run();
Low
Ai Review Evidence
The generator wrapper delegates route generation to @tanstack/router-generator.
dist/cjs/generate.cjsView on unpkg · L3package.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High1 Medium5 Low
HighCopied Package Dependency Bridgedist/cjs/generate.cjs
HighSemantic Analysis Limitedpackage.json
MediumStructural Risk Force Deep Review
LowScripts Present
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/cjs/generate.cjs
LowAi Review Evidencedist/cjs/watch.cjs
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @tanstack/router-cli@1.167.36.
See all versions of @tanstack/router-cli for other recorded verdicts.
- Review the evidence and your use of @tanstack/router-cli@1.167.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.