@tanstack/router-cli@1.167.39
Modern and scalable routing for React applications
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source shows an ordinary CLI delegating route generation to its declared, version-matched dependency, with no install lifecycle hook in the manifest. The scanner’s dependency-bridge signal is consistent with the package’s stated CLI function; no concrete attack behavior was found.
Decision evidence
public snapshot- The manifest declares @tanstack/router-generator as a runtime dependency at the matching version.
- The flagged generator module passes configuration and the project root to that dependency’s Generator and runs it.
- The CLI exposes generate and watch commands that operate on the current project directory.
- The manifest scripts shown contain build and development tasks, with no install lifecycle hook.
Source & flagged code
5 flagged · loading sourcePackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/cjs/generate.cjsView on unpkg · L1The flagged generator module passes configuration and the project root to that dependency’s Generator and runs it.
dist/cjs/generate.cjsView on unpkg · L3Findings
Affected versions and remediation
This report applies to @tanstack/router-cli@1.167.39.
See all versions of @tanstack/router-cli for other recorded verdicts.
- Review the evidence and your use of @tanstack/router-cli@1.167.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.