registry / autotel-adapters / 2.0.21

autotel-adapters@2.0.21

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The flagged files show framework adapter and stream lifecycle behavior, and the manifest has no install hook or runtime self-dependency. Static hints alone do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Importing the package or invoking its exported framework adapters.

Impact

No confirmed attack impact or attack surface was established.

Mechanism

The inspected code enriches logging context from requests and observes response streams; no concrete malicious behavior was found.

AI rationale

The flagged files show framework adapter and stream lifecycle behavior, and the manifest has no install hook or runtime self-dependency. Static hints alone do not establish malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json lists autotel and autotel-edge as runtime dependencies, with no self-dependency.
package.json scripts contain build, development, checking, lint, test, and clean commands; no install lifecycle hook is listed.
dist/cloudflare.cjs derives request metadata and configures a Cloudflare logger adapter.
dist/integration-DfduKDZQ.cjs imports the toolkit and autotel dependencies and contains response-stream handling.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.3 KB of source

Source & flagged code

7 flagged

dist/cloudflare.cjsView file

Lines 1-25javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-DfduKDZQ.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

Low

Ai Review Evidence

dist/cloudflare.cjs derives request metadata and configures a Cloudflare logger adapter.

dist/cloudflare.cjsView on unpkg · L5

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

24 "cloudflare.city": request.cf?.city

25 };

dist/integration-DfduKDZQ.cjsView file

Lines 1-54javascript

1const require_toolkit_storage = require('./toolkit/storage.cjs');

2let autotel = require("autotel");

3let autotel_edge = require("autotel-edge"

package.jsonView file

Lines 68-108json

68 "import": "./dist/nestjs.js",

69 "require": "./dist/nestjs.cjs"

70 },

71 "./sveltekit": {

72 "types": "./dist/sveltekit.d.ts",

73 "import":

Source & flagged code

7 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

5//#region src/cloudflare.ts const requestLoggers = /* @__PURE__ */ new WeakMap(); function enrichFromRequest(request) { if (!request) return void 0; let route = "/"; if (request.url) try

Low

Ai Review Evidence

dist/cloudflare.cjs derives request metadata and configures a Cloudflare logger adapter.

dist/cloudflare.cjsView on unpkg · L5

dist/integration-DfduKDZQ.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-adapters@2.0.19 matchedIdentity = npm:YXV0b3RlbC1hZGFwdGVycw:2.0.19 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Findings

2 High2 Medium6 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

HighPrevious Version Dangerous Deltadist/integration-DfduKDZQ.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

LowSuspicious Dependency Evidencedist/integration-DfduKDZQ.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.21.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:32:20.319Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.