registry / autotel-adapters / 2.0.16

autotel-adapters@2.0.16

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static inspection finds no lifecycle hook or concrete malicious behavior. The scanner's dependency-bridge signal is explained by the Cloudflare adapter's normal imports of declared telemetry dependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports and invokes a framework adapter wrapper.

Impact

The package itself shows no network, shell, file, persistence, or install-time behavior.

Mechanism

Framework request tracing and logger enrichment.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest contains only development scripts and no install lifecycle hook.
The flagged Cloudflare CommonJS file is a framework wrapper: it imports local integration helpers and the declared autotel dependency, then invokes the caller-provided handler.
No package source matches network requests, shell execution, dynamic evaluation, filesystem access, or agent-control configuration mutation.

Evidence against

The adapter resolves optional configuration values from process environment variables at runtime.
The Cloudflare wrapper records request metadata such as URL, route, request ID, and Cloudflare location into its logger.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

3 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

package.jsonView file

Lines 116-144json

116 "optional": true

117 },

118 "nitropack": {

119 "optional": true

120 }

121 },

122 "devDependencies": {

123

Source & flagged code

3 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => { require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext)); return handler(request, env, executionContext); }));

Low

Suspicious Dependency Evidence

The flagged Cloudflare CommonJS file is a framework wrapper: it imports local integration helpers and the declared autotel dependency, then invokes the caller-provided handler.

dist/cloudflare.cjsView on unpkg · L68

package.jsonView file

Findings

1 High2 Medium3 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencedist/cloudflare.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.16.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-05 05:46:20.014Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.