Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

autotel-adapters@2.0.15: Clean npm security report (Allow) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 7 low-signal pattern(s) reviewed.

View on npm All versions

registry / autotel-adapters / 2.0.15

autotel-adapters@2.0.15

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package exposes framework request-logging adapters.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports an adapter and calls its framework wrapper.

Impact

No package-originated network, command execution, file mutation, persistence, or credential exfiltration was identified.

Mechanism

Caller-invoked telemetry context and configuration helpers.

Rationale

Direct inspection found no lifecycle hook or malicious primitive. The flagged module is a normal framework adapter, and environment reads are configuration resolution only.

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

The manifest contains only development scripts and no automatic install lifecycle hook.
The flagged Cloudflare CommonJS module imports declared telemetry code and wraps a caller-provided handler; it does not run shell commands or make network calls.
Environment access is limited to resolving caller-configured adapter fields from named environment keys.

Evidence against

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

4 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => { require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext)); return handler(request, env, executionContext); }));

Low

Ai Review Evidence

The flagged Cloudflare CommonJS module imports declared telemetry code and wraps a caller-provided handler; it does not run shell commands or make network calls.

dist/cloudflare.cjsView on unpkg · L68

package.jsonView file

136"scripts": { "build": "tsdown", "dev": "tsdown --watch", "type-check": "tsc --noEmit", "lint": "eslint src", "test": "vitest run", "clean": "rimraf dist" }

Low

Suspicious Lifecycle Evidence

The manifest contains only development scripts and no automatic install lifecycle hook.

package.jsonView on unpkg · L136

dist/core.jsView file

44function resolveEnv(envKeys) { if (!envKeys) return void 0; for (const key of envKeys) { const value = process.env[key]; if (value) return value; } }

Low

Ai Review Evidence

Environment access is limited to resolving caller-configured adapter fields from named environment keys.

dist/core.jsView on unpkg · L44

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/core.js

96%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Maintainersjagreehal

Version2.0.16

PublishedAug 31, 2026

LicenseApache-2.0

Dependencies9

Integrityverified

Package size35.4 KB

Files63

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact157 KB · 63 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, clean, dev, lint +2

Behavioral surface

EnvironmentVarsSupply chain: cleanManifest: clean

LPM CLI

Source & flagged code

4 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

5

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

package.jsonView file

Lines 116-144json

116 "optional": true

117 },

118 "nitropack": {

119 "optional": true

120 }

121 },

122 "devDependencies": {

123

dist/core.jsView file

Lines 24-64javascript

24* wide event when the handler settles (unless `autoEmit` is `false`).

25*/

26function createRequestRunner(storage) {

27 return function runRequest(spanName,

)

??

require_core.

getHeader

(request.headers,

"cf-ray"

)

54 }),

55 attachLogger: ({ request }, logger) => {

56 requestLoggers.set(request, logger);

57 },

58 extractWaitUntil: ({ executionContext }) => {

59 return typeof executionContext.waitUntil === "function" ? executionContext.waitUntil.bind(executionContext) : void 0;

60 }

61 });

62}

63const integration = createIntegration();

64function resolveSpanName(request, env, options) {

65 if (typeof options?.spanName === "function") return options.spanName(request, env);

66 return options?.spanName ?? `cloudflare.${request.method ?? "request"}`;

67}

68function withAutotelFetch(handler, options) {

69 return async (request, env, executionContext) => {

70 const ctx = {

71 request,

72 env,

73 executionContext

74 };

75 try {

76 return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => {

77 require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext));

78 return handler(request, env, executionContext);

79 }));

Low

Ai Review Evidence

The flagged Cloudflare CommonJS module imports declared telemetry code and wraps a caller-provided handler; it does not run shell commands or make network calls.

dist/cloudflare.cjsView on unpkg · L68

80 } finally {

81 requestLoggers.delete(request);

82 }

83 };

84}

85

86//#endregion

87exports.createDrainPipeline = autotel.createDrainPipeline;

88exports.createStructuredError = autotel.createStructuredError;

"@types/node"

:

"^26.1.2"

,

124 "hono": "^4.12.32",

125 "rimraf": "^6.1.3",

126 "rxjs": "^7.8.2",

127 "tsdown": "^0.22.14",

128 "typescript": "^6.0.3",

129 "vitest": "^4.1.10"

130 },

131 "repository": {

132 "type": "git",

133 "url": "https://github.com/jagreehal/autotel",

134 "directory": "packages/autotel-adapters"

135 },

136 "scripts": {

137 "build": "tsdown",

138 "dev": "tsdown --watch",

139 "type-check": "tsc --noEmit",

140 "lint": "eslint src",

141 "test": "vitest run",

142 "clean": "rimraf dist"

143 }

Low

Suspicious Lifecycle Evidence

The manifest contains only development scripts and no automatic install lifecycle hook.

package.jsonView on unpkg · L136

144}

enrich

,

handler

,

options

) {

28 if (options?.path && !shouldInstrumentPath(options.path, options)) return Promise.resolve(handler());

29 const loggerOptions = mergeRequestLoggerOptions(options?.requestLoggerOptions, options?.waitUntil);

30 return trace.run(spanName, async (ctx) => {

31 const log = getRequestLogger(ctx, loggerOptions);

32 enrich(log);

33 try {

34 return await storage.run(log, () => handler());

35 } catch (error) {

36 log.error(error instanceof Error ? error : new Error(String(error)));

37 throw error;

38 } finally {

39 if (options?.autoEmit !== false) log.emitNow(options?.finalize?.());

40 }

41 });

42 };

43}

44function resolveEnv(envKeys) {

45 if (!envKeys) return void 0;

46 for (const key of envKeys) {

47 const value = process.env[key];

48 if (value) return value;

49 }

50}

Low

Ai Review Evidence

Environment access is limited to resolving caller-configured adapter fields from named environment keys.

dist/core.jsView on unpkg · L44

51/**

52* Returns true when at least one env-backed field is not provided via

53* `overrides`, meaning runtime config may still contribute and should be

54* probed to preserve precedence (`overrides > runtime > env`).

55*

56* @example

57* ```ts

58* const FIELDS: ConfigField<MyAdapterConfig>[] = [

59* { key: 'token', env: ['MY_ADAPTER_TOKEN'] },

60* { key: 'endpoint', env: ['MY_ADAPTER_URL'] },

61* ]

62*

63* if (shouldProbeRuntime(FIELDS, overrides)) {

64* runtimeConfig = await loadRuntimeConfig()