No confirmed malicious attack surface. Runtime imports expose server-side Solid router rendering helpers only.
Static reason
No blocking static signals were detected.
Trigger
Application imports a handler and serves an SSR or streaming request.
Impact
No package-controlled persistence, exfiltration, remote execution, or destructive behavior observed.
Mechanism
Delegates to TanStack router SSR APIs and renders `StartServer`.
Rationale
Source and distributed runtime files are consistent SSR wrappers around TanStack dependencies. The wildcard Vite development dependency is not an executable attack chain in this package and no concrete malicious behavior was found.
Evidence
package.jsonsrc/StartServer.tsxsrc/defaultRenderHandler.tsxsrc/defaultStreamHandler.tsxsrc/index.tsxdist/esm/StartServer.jsdist/esm/defaultRenderHandler.jsdist/esm/defaultStreamHandler.jsdist/esm/index.jsREADME.md