registry / @tanstack/router-cli / 1.167.42

@tanstack/router-cli@1.167.42

Modern and scalable routing for React applications

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The scanner’s dependency-bridge finding resolves to the package’s declared matching generator dependency, used for route generation. The manifest has no install lifecycle hook, and reviewed runtime behavior is consistent with the CLI’s stated routing purpose.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the tsr generate or tsr watch command.

Impact

The observed effects are route generation and updates to generated routes; no harmful effect was identified.

Mechanism

The CLI loads project configuration and runs the declared route generator; watch mode observes the configured routes and regenerates them when files change.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares the matching @tanstack/router-generator dependency and a tsr CLI entrypoint; its scripts show no install lifecycle hook.
The CLI runs route generation only through its generate command, using the project configuration and current directory.
The flagged module calls the declared generator dependency to generate routes; the watch code observes the configured routes directory.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 8.55 KB of source

Source & flagged code

8 flagged

dist/cjs/generate.cjsView file

Lines 1-18javascript

1let _tanstack_router_generator = require("@tanstack/router-generator");

2//#region src/generate.ts

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/generate.cjsView on unpkg · L1

3async function generate(config, root) {

4 try {

5 await new _tanstack_router_generator.Generator({

6 config,

7 root

8 }).run();

9 process.exit(0);

Low

Suspicious Dependency Evidence

The flagged module calls the declared generator dependency to generate routes; the watch code observes the configured routes directory.

dist/cjs/generate.cjsView on unpkg · L1

10 } catch (err) {

11 console.error(err);

12 process.exit(1);

13 }

14}

15//#endregion

16exports.generate = generate;

18//# sourceMappingURL=generate.cjs.map

package.jsonView file

Lines 35-83json

35 },

36 "require": {

37 "types": "./dist/cjs/index.d.cts",

38 "default": "./dist/cjs/index.cjs"

39 }

40 },

41 "./package.json": "./package.json"

bin/tsr.cjsView file

Lines 1-4javascript

1#!/usr/bin/env node

3require('../dist/cjs/index.cjs')

Low

Suspicious Lifecycle Evidence

The manifest declares the matching @tanstack/router-generator dependency and a tsr CLI entrypoint; its scripts show no install lifecycle hook.

bin/tsr.cjsView on unpkg · L1

src/index.tsView file

Lines 1-26typescript

1import yargs from 'yargs'

2import { hideBin } from 'yargs/helpers'

3import { getConfig } from '@tanstack/router-generator'

4import { generate } from './generate'

5import { watch } from

src/watch.tsView file

Lines 1-46typescript

1import chokidar from 'chokidar'

2import {

3 Generator,

4 getConfig,

5 resolveConfigPath,

6} from '@tanstack/router-generator'

7import type { FileEventType } from

Source & flagged code

8 flagged · loading source

dist/cjs/generate.cjsView file

1package = @tanstack/router-cli; repositoryIdentity = router; dependency = @tanstack/router-generator L1: let _tanstack_router_generator = require("@tanstack/router-generator"); L2: //#region src/generate.ts

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/generate.cjsView on unpkg · L1

1let _tanstack_router_generator = require("@tanstack/router-generator"); //#region src/generate.ts async function generate(config, root) { try { await new _tanstack_router_generator.Generator({ config, root }).run(); process.exi

Low

Suspicious Dependency Evidence

The flagged module calls the declared generator dependency to generate routes; the watch code observes the configured routes directory.

dist/cjs/generate.cjsView on unpkg · L1

package.jsonView file

55"dependencies": { "chokidar": "^5.0.0", "yargs": "^17.7.2", "@tanstack/router-generator": "1.167.42" }, "devDepe

Findings

1 High1 Medium8 Low

HighCopied Package Dependency Bridgedist/cjs/generate.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencebin/tsr.cjs

LowAi Review Evidencesrc/index.ts

LowSuspicious Dependency Evidencedist/cjs/generate.cjs

LowSuspicious Dependency Evidencesrc/watch.ts

Affected versions and remediation

This report applies to @tanstack/router-cli@1.167.42.

See all versions of @tanstack/router-cli for other recorded verdicts.

Review the evidence and your use of @tanstack/router-cli@1.167.42 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 23:21:21.631Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @tanstack

Behavioral surface

Related packages

More from @tanstack

Source & flagged code