registry / autotel-adapters / 2.0.19

autotel-adapters@2.0.19

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The static hint is explained by normal environment-backed configuration and a Cloudflare handler wrapper. Direct inspection found no lifecycle execution or concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer explicitly imports and uses an adapter around a request handler.

Impact

The adapter records request metadata through its declared autotel dependencies; it does not itself exfiltrate data or alter files.

Mechanism

Request metadata enrichment and tracing delegation.

AI rationale

The static hint is explained by normal environment-backed configuration and a Cloudflare handler wrapper. Direct inspection found no lifecycle execution or concrete malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest contains development scripts only and no install lifecycle hook.
The flagged Cloudflare bundle is a request-tracing wrapper that calls the handler supplied by the consumer.
Environment access only resolves named configuration keys.

Evidence against

No child-process, filesystem-write, dynamic-code, or network API use was found in distributed JavaScript.
No self-dependency, installer, persistence, or AI-agent configuration mutation is present.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

3 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

package.jsonView file

Lines 118-146json

118 "optional": true

119 },

120 "nitropack": {

121 "optional": true

122 }

123 },

124 "devDependencies": {

125

Source & flagged code

3 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, async () => { require_integration.applyLoggerEnrichment(handle.logger, enrichFromRequest(request), options?.enrichRequest?.(request, env, executionContext)); return handler(request, env, executionContext); }));

Low

Ai Review Evidence

The flagged Cloudflare bundle is a request-tracing wrapper that calls the handler supplied by the consumer.

dist/cloudflare.cjsView on unpkg · L68

package.jsonView file

Findings

1 High2 Medium3 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.19.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 03:01:47.065Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.