Loading npm security reports…

@tanstack/router-cli@1.167.46: Clean npm security report (Allow) | LPM Firewall

registry / @tanstack/router-cli / 1.167.46

@tanstack/router-cli@1.167.46

Modern and scalable routing for React applications

AI Security Review

scanned 18h ago · by lpm-firewall-ai

The flagged dependency bridge resolves to the declared @tanstack/router-generator at the same version and its source exports the expected generator API. The CLI's route generation and file watching are user-invoked product functions, with no confirmed attack behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

The CLI runs when a user invokes its generate or watch command; the package has no install lifecycle hook.

Impact

No unauthorized access, data transfer, or other attack impact was identified.

Mechanism

The generate command loads project configuration and invokes the route generator; the watch command starts file watching.

AI rationale

The flagged dependency bridge resolves to the declared @tanstack/router-generator at the same version and its source exports the expected generator API. The CLI's route generation and file watching are user-invoked product functions, with no confirmed attack behavior.

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest declares ordinary CLI dependencies and no install lifecycle hook; its CLI runs route generation or file watching through explicit commands.
The inspected dependency snapshots provide CLI parsing, filesystem watching, and route generation. The flagged wrapper calls the declared same-version TanStack generator.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 9.70 KB of source

Source & flagged code

9 flagged · loading source

dist/cjs/generate.cjsView file

1package = @tanstack/router-cli; repositoryIdentity = router; dependency = @tanstack/router-generator L1: let _tanstack_router_generator = require("@tanstack/router-generator"); L2: //#region src/generate.ts

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/generate.cjsView on unpkg · L1

package.jsonView file

55"dependencies": { "cac": "^7.1.0", "chokidar": "^5.0.0", "@tanstack/router-generator": "1.167.46" }, "devDependencies": { "@types/node": ">=

Low

Suspicious Lifecycle Evidence

The package manifest declares ordinary CLI dependencies and no install lifecycle hook; its CLI runs route generation or file watching through explicit commands.

package.jsonView on unpkg · L55

69"scripts": { "clean": "rimraf ./dist && rimraf ./coverage", "test:eslint": "eslint ./src", "test:types": "pnpm run \"/^test:types:ts[0-9]{2}$/\"", "t

Findings

1 High1 Medium9 Low

HighCopied Package Dependency Bridgedist/cjs/generate.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencedist/cjs/index.cjs

LowSuspicious Dependency Evidence.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/0/npm-linux/package.json

LowSuspicious Dependency Evidence.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/0/npm-linux/dist/index.js

LowSuspicious Dependency Evidence.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/1/npm-linux/package.json

LowSuspicious Dependency Evidence.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/1/npm-linux/index.js

Affected versions and remediation

This report applies to @tanstack/router-cli@1.167.46.

See all versions of @tanstack/router-cli for other recorded verdicts.

Review the evidence and your use of @tanstack/router-cli@1.167.46 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 05:05:29.716Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Source & flagged code

9 flagged

dist/cjs/generate.cjsView file

Lines 1-18javascript

1let _tanstack_router_generator = require("@tanstack/router-generator");

2//#region src/generate.ts

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/generate.cjsView on unpkg · L1

3async function generate(config, root) {

4 try {

5 await new _tanstack_router_generator.Generator({

6 config,

7 root

8 }).run();

9 process.exit(0);

10 } catch (err) {

11 console.error(err);

12 process.exit(1);

13 }

14}

15//#endregion

16exports.generate = generate;

17

18//# sourceMappingURL=generate.cjs.map

package.jsonView file

Lines 35-82json

35 },

36 "require": {

37 "types": "./dist/cjs/index.d.cts",

38 "default": "./dist/cjs/index.cjs"

39 }

40 },

41 "./package.json": "./package.json"

dist/cjs/index.cjsView file

Lines 1-30javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_generate = require("./generate.cjs");

3const require_watch = require("./watch.cjs"

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/0/npm-linux/package.jsonView file

74"release": "bumpp" } }

Low

Suspicious Dependency Evidence

The inspected dependency snapshots provide CLI parsing, filesystem watching, and route generation. The flagged wrapper calls the declared same-version TanStack generator.

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/0/npm-linux/package.jsonView on unpkg · L74

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/0/npm-linux/dist/index.jsView file

540const commandName = parsed.args[0]; if (command.isMatched(commandName)) { shouldParse = false; const parsedInfo = { ...parsed,

Low

Suspicious Dependency Evidence

The inspected dependency snapshots provide CLI parsing, filesystem watching, and route generation. The flagged wrapper calls the declared same-version TanStack generator.

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/0/npm-linux/dist/index.jsView on unpkg · L540

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/1/npm-linux/package.jsonView file

2"name": "chokidar", "description": "Minimal and efficient cross-platform file watching library", "version": "5.0.0", "type": "module", "homepage": "http

Low

Suspicious Dependency Evidence

The inspected dependency snapshots provide CLI parsing, filesystem watching, and route generation. The flagged wrapper calls the declared same-version TanStack generator.

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/1/npm-linux/package.jsonView on unpkg · L2

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/1/npm-linux/index.jsView file

4import { readdir, stat } from 'node:fs/promises'; import * as sp from 'node:path'; import { readdirp, ReaddirpStream } from 'readdirp'; import { EMPTY_FN, EVENTS as EV, i

Low

Suspicious Dependency Evidence

The inspected dependency snapshots provide CLI parsing, filesystem watching, and route generation. The flagged wrapper calls the declared same-version TanStack generator.

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/1/npm-linux/index.jsView on unpkg · L4

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/2/npm-linux/package.jsonView file

10"directory": "packages/router-generator" }, "homepage": "https://tanstack.com/router", "funding": { "type": "github", "url": "https

Low

Suspicious Dependency Evidence

The inspected dependency snapshots provide CLI parsing, filesystem watching, and route generation. The flagged wrapper calls the declared same-version TanStack generator.

.lpm-dependency-evidence-5df7ad2e-7996-41b4-b38c-cf65c7418d15/2/npm-linux/package.jsonView on unpkg · L10