registry / autotel-adapters / 2.0.17
autotel-adapters@2.0.17
Framework adapters and composable DX helpers for autotel
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection shows a non-lifecycle framework adapter package with tracing wrappers and limited configuration reads. The scanner's dependency-bridge and environment-variable signals are package-aligned and do not establish attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer explicitly imports and invokes an adapter wrapper.
Impact
No package-originated exfiltration, mutation, or command execution was observed.
Mechanism
Request tracing and logger-context wrapping.
AI rationale
Static inspection shows a non-lifecycle framework adapter package with tracing wrappers and limited configuration reads. The scanner's dependency-bridge and environment-variable signals are package-aligned and do not establish attack behavior.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest contains only development scripts and no npm lifecycle hook.
- The Cloudflare adapter wraps a caller-supplied handler in tracing and returns that handler's result.
- Environment access only resolves named adapter configuration values.
Evidence against
- No outbound network primitive, shell execution, filesystem mutation, dynamic code execution, or persistence behavior was found in the inspected runtime source.
- The flagged Cloudflare CommonJS dependency bridge is ordinary loading of the declared autotel dependency.
Behavioral surface
EnvironmentVars
Source & flagged code
4 flagged · loading sourcedist/cloudflare.cjsView file
3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel
L3: const require_core = require('./core.cjs');
L4: let autotel = require("autotel");
L5:
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/cloudflare.cjsView on unpkg · L376return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => {
require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext));
return handler(request, env, executionContext);
}));
Low
Ai Review Evidence
The Cloudflare adapter wraps a caller-supplied handler in tracing and returns that handler's result.
dist/cloudflare.cjsView on unpkg · L76package.jsonView file
136"scripts": {
"build": "tsdown",
"dev": "tsdown --watch",
"type-check": "tsc --noEmit",
"lint": "eslint src",
"test": "vitest run",
"clean": "rimraf dist"
}
Findings
1 High2 Medium4 Low
HighCopied Package Dependency Bridgedist/cloudflare.cjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cloudflare.cjs
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to autotel-adapters@2.0.17.
See all versions of autotel-adapters for other recorded verdicts.
- Review the evidence and your use of autotel-adapters@2.0.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.