registry / @tanstack/router-cli / 1.167.43

@tanstack/router-cli@1.167.43

Modern and scalable routing for React applications

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The flagged dependency bridge forwards project configuration to the declared route generator, and the CLI runs generation only through its commands. The manifest has no lifecycle hook, and inspected source showed no concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the tsr generate or tsr watch command.

Impact

No malicious impact was identified; the observed behavior generates project routes.

Mechanism

The CLI reads project configuration and runs the declared route generator; watch mode reruns it when configuration or route files change.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json scripts end with ordinary build and type-check commands; no lifecycle hook is declared.
package.json declares @tanstack/router-generator as a dependency, and generate.cjs calls its Generator with the supplied config and project root.
The CLI exposes generate and watch commands for the current project; watch observes the config and routes and reruns generation.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 8.55 KB of source

Source & flagged code

7 flagged

dist/cjs/generate.cjsView file

Lines 1-18javascript

1let _tanstack_router_generator = require("@tanstack/router-generator");

2//#region src/generate.ts

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/generate.cjsView on unpkg · L1

3async function generate(config, root) {

4 try {

5 await new _tanstack_router_generator.Generator({

6 config,

7 root

8 }).run();

9 process.exit(0);

10 } catch (err) {

11 console.error(err);

12 process.exit(1);

13 }

14}

Low

Suspicious Dependency Evidence

package.json declares @tanstack/router-generator as a dependency, and generate.cjs calls its Generator with the supplied config and project root.

dist/cjs/generate.cjsView on unpkg · L3

15//#endregion

16exports.generate = generate;

18//# sourceMappingURL=generate.cjs.map

package.jsonView file

Lines 35-83json

35 },

36 "require": {

37 "types": "./dist/cjs/index.d.cts",

38 "default": "./dist/cjs/index.cjs"

39 }

40 },

41 "./package.json": "./package.json"

bin/tsr.cjsView file

Lines 1-4javascript

1#!/usr/bin/env node

3require('../dist/cjs/index.cjs')

Low

Ai Review Evidence

The CLI exposes generate and watch commands for the current project; watch observes the config and routes and reruns generation.

bin/tsr.cjsView on unpkg · L3

dist/cjs/index.cjsView file

Lines 1-22javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_runtime = require("./_virtual/_rolldown/runtime.cjs");

3const require_generate = require("./generate.cjs"

dist/cjs/watch.cjsView file

Lines 1-26javascript

1const require_runtime = require("./_virtual/_rolldown/runtime.cjs");

2let _tanstack_router_generator = require("@tanstack/router-generator");

3let chokidar = require("chokidar");

Source & flagged code

7 flagged · loading source

dist/cjs/generate.cjsView file

1package = @tanstack/router-cli; repositoryIdentity = router; dependency = @tanstack/router-generator L1: let _tanstack_router_generator = require("@tanstack/router-generator"); L2: //#region src/generate.ts

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/generate.cjsView on unpkg · L1

3async function generate(config, root) { try { await new _tanstack_router_generator.Generator({ config, root }).run(); process.exit(0); } catch (err) { console.error(err); process.exit(1); } }

Low

Suspicious Dependency Evidence

package.json declares @tanstack/router-generator as a dependency, and generate.cjs calls its Generator with the supplied config and project root.

dist/cjs/generate.cjsView on unpkg · L3

package.jsonView file

78types:ts60": "tsc6", "test:types:ts70": "tsc", "test:build": "publint --strict && attw --ignore-rules no-resolution --pack .", "build": "vite build" } }

Findings

1 High1 Medium7 Low

HighCopied Package Dependency Bridgedist/cjs/generate.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/cjs/generate.cjs

LowAi Review Evidencebin/tsr.cjs

LowAi Review Evidencedist/cjs/index.cjs

LowAi Review Evidencedist/cjs/watch.cjs

Affected versions and remediation

This report applies to @tanstack/router-cli@1.167.43.

See all versions of @tanstack/router-cli for other recorded verdicts.

Review the evidence and your use of @tanstack/router-cli@1.167.43 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 23:59:29.728Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @tanstack

Behavioral surface

Related packages

More from @tanstack

Source & flagged code