registry / autotel-adapters / 2.0.18

autotel-adapters@2.0.18

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source inspection shows a telemetry adapter package with no install lifecycle hook and no malicious primitives. The reported environment and Cloudflare signals are consistent with runtime adapter configuration and request tracing.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports and invokes an adapter wrapper.

Impact

No package-originated exfiltration, execution, persistence, or mutation was found.

Mechanism

Request logging and tracing integration.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no preinstall, install, or postinstall hook.
The Cloudflare module is a request-tracing wrapper that calls the supplied handler.
Environment access resolves only caller-selected configuration key names.

Evidence against

No network client, shell execution, dynamic code execution, or filesystem mutation was found in distributed JavaScript.
The high-severity Cloudflare finding is ordinary runtime dependency loading and request logging, not a dependency bridge or payload loader.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

4 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

package.jsonView file

Lines 118-146json

118 "optional": true

119 },

120 "nitropack": {

121 "optional": true

122 }

123 },

124 "devDependencies": {

125

dist/core.jsView file

Lines 24-64javascript

24* wide event when the handler settles (unless `autoEmit` is `false`).

25*/

26function createRequestRunner(storage) {

27 return function runRequest(spanName,

Source & flagged code

4 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => { require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext)); return handler(request, env, executionContext); }));

Low

Ai Review Evidence

The Cloudflare module is a request-tracing wrapper that calls the supplied handler.

dist/cloudflare.cjsView on unpkg · L68

package.jsonView file

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/core.js

Affected versions and remediation

This report applies to autotel-adapters@2.0.18.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 23:41:17.593Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.