@tanstack/start-static-server-functions@1.167.31: Clean npm | LPM Firewall

Loading npm security reports…

@tanstack/start-static-server-functions@1.167.31: Clean npm | LPM Firewall

Source & flagged code

4 flagged · loading source

src/staticFunctionMiddleware.tsView file

•matchType = malicious_source_fingerprint_signature signature = 3e7028705200d395 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @tanstack/start-static-server-functions@1.166.44 matchedPath = src/staticFunctionMiddleware.ts matchedIdentity = npm:[redacted]:1.166.44 similarity = 1.000 shingleOverlap = 2 summary = Datadog malicious npm corpus sample: samples/npm/compromised_lib/@tanstack@start-static-server-functions/1.166.44/2026-05-11-@tanstack_start-static-server-functions-v1.166.44.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/staticFunctionMiddleware.tsView on unpkg

87const clientUrl = process.env.TSS_CLIENT_OUTPUT_DIR! const filePath = path.join(clientUrl, url) // Ensure the directory exists await fs.mkdir(path.dirname(filePath), { recursive: true }) // Store the result with fs const stringifiedResult = JSON.stringify( await toJSONAsync( { result: response.result, context: response.context.sendContext, }, { plugins: getDefaultSerovalPlugins() }, ), ) await fs.writeFile(filePath, stringifiedResult, 'utf-8')

Low

Ai Review Evidence

The sole middleware writes serialized static server-function results only when production output configuration is set.

src/staticFunctionMiddleware.tsView on unpkg · L87

114const hash = jsonToFilenameSafeString(data) const url = await getStaticCacheUrl({ functionId, hash }) let result: any = staticClientCache?.get(url) result = await fetch(url, { method: 'GET', }) .then((r) => r.json()) .then((d) => fromJSON(d, { plugins: getDefaultSerovalPlugins() }))

Low

Ai Review Evidence

Client fetches a package-relative static-cache path; no external host is embedded.

src/staticFunctionMiddleware.tsView on unpkg · L114

package.jsonView file

71"scripts": { "clean": "rimraf ./dist && rimraf ./coverage", "test": "pnpm test:eslint && pnpm test:types && pnpm test:build && pnpm test:unit", "test:unit": "exit 0; vitest", "test:unit:dev": "vitest --watch", "test:eslint": "eslint ./src", "test:types": "pnpm run \"/^test:types:ts[0-9]{2}$/\"", "test:types:ts56": "node ../../node_modules/typescript56/lib/tsc.js", "test:types:ts57": "node ../../node_modules/typescript57/lib/tsc.js", "test:types:ts58": "node ../../node_modules/typescript58/lib/tsc.js", "test:types:ts59": "node ../../node_modules/typesc

Low

Suspicious Lifecycle Evidence

No preinstall, install, or postinstall lifecycle hook is declared.

package.jsonView on unpkg · L71

Source & flagged code

4 flagged

src/staticFunctionMiddleware.tsView file

Lines 67-134typescript

67 return jsonString

68 .replace(/[/\\?%*:|"<>]/g, '-') // Replace invalid characters with a dash

69 .replace(/\s+/g, '_') // Optionally replace whitespace with underscores

70}

71

72const staticClientCache =

73 typeof document !== 'undefined' ? new Map<string, any>() : null

74

75async function addItemToCache({

76 functionId,

77 data,

78 response,

79}: {

80 functionId: string

81 data: any

82 response: StaticCachedResult

83}): Promise<void> {

84 {

85 const hash = jsonToFilenameSafeString(data)

86 const url = await getStaticCacheUrl({ functionId, hash })

87 const clientUrl = process.env.TSS_CLIENT_OUTPUT_DIR!

88 const filePath = path.join(clientUrl, url)

89

90 // Ensure the directory exists

91 await fs.mkdir(path.dirname(filePath), { recursive: true })

92

93 // Store the result with fs

94 const stringifiedResult = JSON.stringify(

95 await toJSONAsync(

96 {

97 result: response.result,

98 context: response.context.sendContext,

Low

Ai Review Evidence

The sole middleware writes serialized static server-function results only when production output configuration is set.

src/staticFunctionMiddleware.tsView on unpkg · L87

99 },

100 { plugins: getDefaultSerovalPlugins() },

101 ),

102 )

103 await fs.writeFile(filePath, stringifiedResult, 'utf-8')

104 }

105}

106

107const fetchItem = async ({

108 data,

109 functionId,

110}: {

111 data: any

112 functionId: string

113}) => {

114 const hash = jsonToFilenameSafeString(data)

115 const url = await getStaticCacheUrl({ functionId, hash })

116

117 let result: any = staticClientCache?.get(url)

118

119 result = await fetch(url, {

120 method: 'GET',

121 })

122 .then((r) => r.json())

123 .then((d) => fromJSON(d, { plugins: getDefaultSerovalPlugins() }))

Low

Ai Review Evidence

Client fetches a package-relative static-cache path; no external host is embedded.

src/staticFunctionMiddleware.tsView on unpkg · L114

124

125 return result

126}

127

128export const staticFunctionMiddleware = createMiddleware({ type: 'function' })

129 .client(async (ctx) => {

130 if (

131 process.env.NODE_ENV === 'production' &&

132 // do not run this during SSR on the server

133 typeof document !== 'undefined'

134 ) {

•matchType = malicious_source_fingerprint_signature signature = 3e7028705200d395 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @tanstack/start-static-server-functions@1.166.44 matchedPath = src/staticFunctionMiddleware.ts matchedIdentity = npm:[redacted]:1.166.44 similarity = 1.000 shingleOverlap = 2 summary = Datadog malicious npm corpus sample: samples/npm/compromised_lib/@tanstack@start-static-server-functions/1.166.44/2026-05-11-@tanstack_start-static-server-functions-v1.166.44.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/staticFunctionMiddleware.tsView on unpkg

package.jsonView file

Lines 51-87json

51 "@types/node": ">=20",

52 "@tanstack/vite-config": "0.5.2",

53 "vitest": "^4.1.4",

54 "jsdom": "^25.0.1",

55 "@arethetypeswrong/cli"