@tanstack/router-cli@1.167.45
Modern and scalable routing for React applications
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe flagged dependency bridge delegates to the declared TanStack router generator, and the CLI invokes it through explicit project commands. The manifest has no install lifecycle hook, and source inspection found no concrete malicious behavior.
Decision evidence
public snapshot- The manifest declares @tanstack/router-generator@1.167.45; the flagged bridge imports it and calls its Generator with the supplied config and project root.
- The package exposes a tsr CLI and has no install lifecycle hook; its bin forwards to the CLI entrypoint.
- The CLI offers explicit generate and watch commands that delegate route generation and watch project configuration and routes.
Source & flagged code
9 flagged · loading sourcePackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/cjs/generate.cjsView on unpkg · L1The manifest declares @tanstack/router-generator@1.167.45; the flagged bridge imports it and calls its Generator with the supplied config and project root.
dist/cjs/generate.cjsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @tanstack/router-cli@1.167.45.
See all versions of @tanstack/router-cli for other recorded verdicts.
- Review the evidence and your use of @tanstack/router-cli@1.167.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.