registry / autotel-adapters / 2.0.13

autotel-adapters@2.0.13

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected source shows framework tracing behavior and declared runtime dependencies, with no install lifecycle hook or concrete malicious behavior. The static hints do not establish an attack.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package or using its Cloudflare adapter for a request.

Impact

The inspected behavior supports request tracing and logging; no malicious action was established.

Mechanism

The adapter gathers request metadata and invokes the package tracing integration; its runtime dependencies are declared in the manifest.

AI rationale

The inspected source shows framework tracing behavior and declared runtime dependencies, with no install lifecycle hook or concrete malicious behavior. The static hints do not establish an attack.

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares `autotel` and `autotel-edge` as runtime dependencies and lists no install lifecycle hook.
The Cloudflare adapter imports its integration and core modules, then extracts request method, path, headers, and request ID for tracing.
The package entrypoint exports framework adapters and request logging helpers.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

6 flagged

dist/cloudflare.cjsView file

Lines 1-63javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

Low

Ai Review Evidence

The Cloudflare adapter imports its integration and core modules, then extracts request method, path, headers, and request ID for tracing.

dist/cloudflare.cjsView on unpkg · L1

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

24 "cloudflare.city": request.cf?.city

25 };

26}

27const baseUseLogger = require_core.createUseLogger({

28 adapterName: "cloudflare",

29 enrich: enrichFromRequest

30});

31function useLogger(request, requestLoggerOptions) {

32 if (request) {

33 const existing = requestLoggers.get(request);

34 if (existing) return existing;

35 }

36 return baseUseLogger(request, requestLoggerOptions);

37}

38function resolvePath(request) {

39 if (!request.url) return "/";

40 try {

41 return new URL(request.url).pathname;

42 } catch {

43 return request.url;

44 }

45}

46function createIntegration() {

47 return require_integration.defineFrameworkIntegration({

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray")

Low

Ai Review Evidence

The Cloudflare adapter imports its integration and core modules, then extracts request method, path, headers, and request ID for tracing.

dist/cloudflare.cjsView on unpkg · L43

54 }),

55 attachLogger: ({ request }, logger) => {

56 requestLoggers.set(request, logger);

57 },

58 extractWaitUntil: ({ executionContext }) => {

59 return typeof executionContext.waitUntil === "function" ? executionContext.waitUntil.bind(executionContext) : void 0;

60 }

61 });

62}

63const integration = createIntegration();

package.jsonView file

Lines 66-144json

66 "./nestjs": {

67 "types": "./dist/nestjs.d.ts",

68 "import": "./dist/nestjs.js",

69 "require": "./dist/nestjs.cjs"

70 },

71 "./sveltekit": {

dist/index.jsView file

Lines 1-13javascript

1import { o as toRouteAdapterOptions } from "./integration-CfkaoVmE.js";

2import { createRequestRunner, createUseLogger, getHeader, resolveAdapterConfig, shouldProbeRuntime } from "./core.js";

Low

Ai Review Evidence

The package entrypoint exports framework adapters and request logging helpers.

dist/index.jsView on unpkg · L1

3import { withAutotel } from "./next.js"

Source & flagged code

6 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_integration = require('./integration-pKawIXb6.cjs'); const require_core = require('./core.cjs'); let au

Low

Ai Review Evidence

The Cloudflare adapter imports its integration and core modules, then extracts request method, path, headers, and request ID for tracing.

dist/cloudflare.cjsView on unpkg · L1

43return request.url; } } function createIntegration() { return require_integration.defineFrameworkIntegration({ name: "cloudflare", extractRequest: ({ request }) => ({ method: request.method ?? "GET", path: resolvePath(request), headers: request.headers, requestId: require_core.ge

Low

Ai Review Evidence

The Cloudflare adapter imports its integration and core modules, then extracts request method, path, headers, and request ID for tracing.

Findings

1 High2 Medium6 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to autotel-adapters@2.0.13.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:32:09.982Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.