@tanstack/start-static-server-functions@1.167.29: Clean npm | LPM Firewall

Loading npm security reports…

@tanstack/start-static-server-functions@1.167.29: Clean npm | LPM Firewall

Source & flagged code

4 flagged · loading source

src/staticFunctionMiddleware.tsView file

•matchType = malicious_source_fingerprint_signature signature = 3e7028705200d395 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @tanstack/start-static-server-functions@1.166.44 matchedPath = src/staticFunctionMiddleware.ts matchedIdentity = npm:[redacted]:1.166.44 similarity = 1.000 shingleOverlap = 2 summary = Datadog malicious npm corpus sample: samples/npm/compromised_lib/@tanstack@start-static-server-functions/1.166.44/2026-05-11-@tanstack_start-static-server-functions-v1.166.44.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/staticFunctionMiddleware.tsView on unpkg

114const hash = jsonToFilenameSafeString(data) const url = await getStaticCacheUrl({ functionId, hash }) let result: any = staticClientCache?.get(url) result = await fetch(url, { method: 'GET', }) .then((r) => r.json()) .then((d) => fromJSON(d, { plugins: getDefaultSerovalPlugins() }))

Low

Ai Review Evidence

Runtime fetch is a relative cache URL, not an external endpoint.

src/staticFunctionMiddleware.tsView on unpkg · L114

85const hash = jsonToFilenameSafeString(data) const url = await getStaticCacheUrl({ functionId, hash }) const clientUrl = process.env.TSS_CLIENT_OUTPUT_DIR! const filePath = path.join(clientUrl, url) // Ensure the directory exists await fs.mkdir(path.dirname(filePath), { recursive: true }) // Store the result with fs const stringifiedResult = JSON.stringify( await toJSONAsync( { result: response.result, context: response.context.sendContext, }, { plugins: getDefaultSerovalPlugins() }, ), ) await fs.

Low

Ai Review Evidence

Filesystem writes are production-only static cache output under TSS_CLIENT_OUTPUT_DIR.

src/staticFunctionMiddleware.tsView on unpkg · L85

package.jsonView file

26"type": "module", "types": "dist/esm/index.d.ts", "exports": { ".": { "import": { "types": "./dist/esm/index.d.ts", "default": "./dist/esm/index.js" } }, "./package.json": "./package.json" }, "sideEffects": false,

Low

Suspicious Lifecycle Evidence

No install lifecycle hook; manifest exposes only ESM entrypoint and marks sideEffects false.

package.jsonView on unpkg · L26

Source & flagged code

4 flagged

src/staticFunctionMiddleware.tsView file

Lines 65-134typescript

65

66 // Replace characters invalid in filenames

67 return jsonString

68 .replace(/[/\\?%*:|"<>]/g, '-') // Replace invalid characters with a dash

69 .replace(/\s+/g, '_') // Optionally replace whitespace with underscores

70}

71

72const staticClientCache =

73 typeof document !== 'undefined' ? new Map<string, any>() : null

74

75async function addItemToCache({

76 functionId,

77 data,

78 response,

79}: {

80 functionId: string

81 data: any

82 response: StaticCachedResult

83}): Promise<void> {

84 {

85 const hash = jsonToFilenameSafeString(data)

86 const url = await getStaticCacheUrl({ functionId, hash })

87 const clientUrl = process.env.TSS_CLIENT_OUTPUT_DIR!

88 const filePath = path.join(clientUrl, url)

89

90 // Ensure the directory exists

91 await fs.mkdir(path.dirname(filePath), { recursive: true })

92

93 // Store the result with fs

94 const stringifiedResult = JSON.stringify(

95 await toJSONAsync(

96 {

Low

Ai Review Evidence

Filesystem writes are production-only static cache output under TSS_CLIENT_OUTPUT_DIR.

src/staticFunctionMiddleware.tsView on unpkg · L85

97 result: response.result,

98 context: response.context.sendContext,

99 },

100 { plugins: getDefaultSerovalPlugins() },

101 ),

102 )

103 await fs.writeFile(filePath, stringifiedResult, 'utf-8')

104 }

105}

106

107const fetchItem = async ({

108 data,

109 functionId,

110}: {

111 data: any

112 functionId: string

113}) => {

114 const hash = jsonToFilenameSafeString(data)

115 const url = await getStaticCacheUrl({ functionId, hash })

116

117 let result: any = staticClientCache?.get(url)

118

119 result = await fetch(url, {

120 method: 'GET',

121 })

122 .then((r) => r.json())

123 .then((d) => fromJSON(d, { plugins: getDefaultSerovalPlugins() }))

Low

Ai Review Evidence

Runtime fetch is a relative cache URL, not an external endpoint.

src/staticFunctionMiddleware.tsView on unpkg · L114

124

125 return result

126}

127

128export const staticFunctionMiddleware = createMiddleware({ type: 'function' })

129 .client(async (ctx) => {

130 if (

131 process.env.NODE_ENV === 'production' &&

132 // do not run this during SSR on the server

133 typeof document !== 'undefined'

134 ) {

•matchType = malicious_source_fingerprint_signature signature = 3e7028705200d395 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @tanstack/start-static-server-functions@1.166.44 matchedPath = src/staticFunctionMiddleware.ts matchedIdentity = npm:[redacted]:1.166.44 similarity = 1.000 shingleOverlap = 2 summary = Datadog malicious npm corpus sample: samples/npm/compromised_lib/@tanstack@start-static-server-functions/1.166.44/2026-05-11-@tanstack_start-static-server-functions-v1.166.44.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/staticFunctionMiddleware.tsView on unpkg

package.jsonView file

Lines 6-46json

6 "license": "MIT",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/TanStack/router.git",

10 "directory": "packages/start-static-server-functions"