Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

autotel-adapters@2.0.14: Clean npm security report (Allow) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 7 low-signal pattern(s) reviewed.

View on npm All versions

registry / autotel-adapters / 2.0.14

autotel-adapters@2.0.14

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime adapters instrument caller-provided HTTP handlers and pass logging data to their declared autotel dependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer explicitly imports and uses an adapter wrapper.

Impact

No direct network endpoint, file mutation, command execution, or credential exfiltration is implemented here.

Mechanism

Request tracing and configuration fallback lookup.

Rationale

The static hint is explained by normal environment-backed configuration and CommonJS dependency imports. Direct inspection found no lifecycle execution or concrete malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

The manifest has no install lifecycle hook and declares its JavaScript entry point.
The flagged Cloudflare module only wraps a caller-provided request handler for tracing.
Environment values are read solely as adapter configuration fallbacks.

Evidence against

No child-process, filesystem-write, network-client, dynamic-code, or agent-control code was found in distributed source.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

The package does not depend on itself.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

4 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => { require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext)); return handler(request, env, executionContext); }));

Low

Ai Review Evidence

The flagged Cloudflare module only wraps a caller-provided request handler for tracing.

dist/cloudflare.cjsView on unpkg · L68

package.jsonView file

1{ "name": "autotel-adapters", "version": "2.0.14", "description": "Framework adapters and composable DX helpers for autotel", "license": "Apache-2.0", "type": "module", "main": "./dist/index.js", "types": "./dist/index.d.ts", "sideEffects": false,

Low

Suspicious Lifecycle Evidence

The manifest has no install lifecycle hook and declares its JavaScript entry point.

package.jsonView on unpkg · L1

dist/core.jsView file

44function resolveEnv(envKeys) { if (!envKeys) return void 0; for (const key of envKeys) { const value = process.env[key]; if (value) return value; } }

Low

Ai Review Evidence

Environment values are read solely as adapter configuration fallbacks.

dist/core.jsView on unpkg · L44

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/core.js

97%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Maintainersjagreehal

Version2.0.16

PublishedAug 31, 2026

LicenseApache-2.0

Dependencies9

Integrityverified

Package size35.4 KB

Files63

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact157 KB · 63 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, clean, dev, lint +2

Behavioral surface

EnvironmentVarsSupply chain: cleanManifest: clean

LPM CLI

Source & flagged code

4 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

5

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

package.jsonView file

Lines 1-21json

1{

2 "name": "autotel-adapters",

3 "version": "2.0.14",

4 "description": "Framework adapters and composable DX helpers for autotel",

5 "license": "Apache-2.0",

6

dist/core.jsView file

Lines 24-64javascript

24* wide event when the handler settles (unless `autoEmit` is `false`).

25*/

26function createRequestRunner(storage) {

27 return function runRequest(spanName,

)

??

require_core.

getHeader

(request.headers,

"cf-ray"

)

54 }),

55 attachLogger: ({ request }, logger) => {

56 requestLoggers.set(request, logger);

57 },

58 extractWaitUntil: ({ executionContext }) => {

59 return typeof executionContext.waitUntil === "function" ? executionContext.waitUntil.bind(executionContext) : void 0;

60 }

61 });

62}

63const integration = createIntegration();

64function resolveSpanName(request, env, options) {

65 if (typeof options?.spanName === "function") return options.spanName(request, env);

66 return options?.spanName ?? `cloudflare.${request.method ?? "request"}`;

67}

68function withAutotelFetch(handler, options) {

69 return async (request, env, executionContext) => {

70 const ctx = {

71 request,

72 env,

73 executionContext

74 };

75 try {

76 return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => {

77 require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext));

78 return handler(request, env, executionContext);

79 }));

Low

Ai Review Evidence

The flagged Cloudflare module only wraps a caller-provided request handler for tracing.

dist/cloudflare.cjsView on unpkg · L68

80 } finally {

81 requestLoggers.delete(request);

82 }

83 };

84}

85

86//#endregion

87exports.createDrainPipeline = autotel.createDrainPipeline;

88exports.createStructuredError = autotel.createStructuredError;

"type"

:

"module"

,

7 "main": "./dist/index.js",

8 "types": "./dist/index.d.ts",

9 "sideEffects": false,

Low

Suspicious Lifecycle Evidence

The manifest has no install lifecycle hook and declares its JavaScript entry point.

package.jsonView on unpkg · L1

10 "exports": {

11 ".": {

12 "types": "./dist/index.d.ts",

13 "import": "./dist/index.js",

14 "require": "./dist/index.cjs"

15 },

16 "./core": {

17 "types": "./dist/core.d.ts",

18 "import": "./dist/core.js",

19 "require": "./dist/core.cjs"

20 },

21 "./hono": {

enrich

,

handler

,

options

) {

28 if (options?.path && !shouldInstrumentPath(options.path, options)) return Promise.resolve(handler());

29 const loggerOptions = mergeRequestLoggerOptions(options?.requestLoggerOptions, options?.waitUntil);

30 return trace.run(spanName, async (ctx) => {

31 const log = getRequestLogger(ctx, loggerOptions);

32 enrich(log);

33 try {

34 return await storage.run(log, () => handler());

35 } catch (error) {

36 log.error(error instanceof Error ? error : new Error(String(error)));

37 throw error;

38 } finally {

39 if (options?.autoEmit !== false) log.emitNow(options?.finalize?.());

40 }

41 });

42 };

43}

44function resolveEnv(envKeys) {

45 if (!envKeys) return void 0;

46 for (const key of envKeys) {

47 const value = process.env[key];

48 if (value) return value;

49 }

50}

Low

Ai Review Evidence

Environment values are read solely as adapter configuration fallbacks.

dist/core.jsView on unpkg · L44

51/**

52* Returns true when at least one env-backed field is not provided via

53* `overrides`, meaning runtime config may still contribute and should be

54* probed to preserve precedence (`overrides > runtime > env`).

55*

56* @example

57* ```ts

58* const FIELDS: ConfigField<MyAdapterConfig>[] = [

59* { key: 'token', env: ['MY_ADAPTER_TOKEN'] },

60* { key: 'endpoint', env: ['MY_ADAPTER_URL'] },

61* ]

62*

63* if (shouldProbeRuntime(FIELDS, overrides)) {

64* runtimeConfig = await loadRuntimeConfig()