registry / autotel-adapters / 2.0.20

autotel-adapters@2.0.20

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected runtime bridge loads the declared autotel dependencies, and the Cloudflare adapter wraps a caller-provided handler for tracing and logging. The manifest defines no install lifecycle hook, and the source reviewed establishes no malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the Cloudflare adapter or calling its exported wrapper.

Impact

No confirmed security impact or attack surface was established.

Mechanism

The wrapper delegates tracing to the integration and invokes the supplied request handler; no malicious action was established.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json lists only build, development, type-check, lint, test, and clean scripts; no install lifecycle hook is defined.
The runtime dependencies are autotel and autotel-edge, and the repository metadata points to the autotel-adapters package directory.
dist/cloudflare.cjs loads its adapter integration and core modules and delegates tracing and logging to them.
The Cloudflare wrapper runs the caller-provided handler within tracing and returns its response.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.2 KB of source

Source & flagged code

5 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-pKawIXb6.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

Low

Ai Review Evidence

dist/cloudflare.cjs loads its adapter integration and core modules and delegates tracing and logging to them.

dist/cloudflare.cjsView on unpkg · L1

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

package.jsonView file

Lines 68-146json

68 "import": "./dist/nestjs.js",

69 "require": "./dist/nestjs.cjs"

70 },

71 "./sveltekit": {

72 "types": "./dist/sveltekit.d.ts",

73 "import":

Source & flagged code

5 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_integration = require('./integration-pKawIXb6.cjs'); const require_core = require('./core.cjs'); l

Low

Ai Review Evidence

dist/cloudflare.cjs loads its adapter integration and core modules and delegates tracing and logging to them.

dist/cloudflare.cjsView on unpkg · L1

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_integration.runWithIntegratedHandle(handle, options, as

Low

Ai Review Evidence

Findings

1 High2 Medium5 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.20.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:32:25.404Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.