registry / autotel-adapters / 2.0.22

autotel-adapters@2.0.22

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Source inspection found no concrete attack behavior in the flagged files. The apparent signals align with framework logging and tracing; the manifest contains no install lifecycle hook.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A consuming application imports and invokes an adapter helper, such as the Cloudflare handler wrapper.

Impact

No malicious effect was established from the inspected source.

Mechanism

The adapter enriches request logging context and completes tracing when the handler returns; the integration records response status and duration.

AI rationale

Source inspection found no concrete attack behavior in the flagged files. The apparent signals align with framework logging and tracing; the manifest contains no install lifecycle hook.

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package has no install lifecycle hook; its scripts build, type-check, lint, test, or clean.
The Cloudflare adapter is activated when a caller wraps a request handler with its exported tracing helper.
The shared integration code records request status, duration, and configured completion callbacks for logging.

Evidence against

The reviewed adapter and integration excerpts show request tracing and logging, with no credential harvesting, outbound request, shell execution, or persistence behavior.
The package entrypoint re-exports framework adapters, and the manifest lists only autotel and autotel-edge as runtime dependencies.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.3 KB of source

Source & flagged code

5 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-DfduKDZQ.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 48-88javascript

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

51 path: resolvePath(request),

52 headers: request.headers,

53 requestId: require_core.getHeader(request.headers, "x-request-id"

dist/integration-DfduKDZQ.cjsView file

Lines 106-146javascript

106

107//#endregion

108//#region src/toolkit/middleware.ts

109const noopResult = {

110 logger: (0, autotel.createNoopRequestLogger)(),

111 finish: () => Promise.resolve(

package.jsonView file

Lines 118-146json

118 "optional": true

119 },

120 "nitropack": {

121 "optional": true

122 }

123 },

124 "devDependencies": {

125

Source & flagged code

5 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

68function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return awa

Low

Ai Review Evidence

The Cloudflare adapter is activated when a caller wraps a request handler with its exported tracing helper.

dist/cloudflare.cjsView on unpkg · L68

dist/integration-DfduKDZQ.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-adapters@2.0.19 matchedIdentity = npm:YXV0b3RlbC1hZGFwdGVycw:2.0.19 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Findings

2 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

HighPrevious Version Dangerous Deltadist/integration-DfduKDZQ.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/integration-DfduKDZQ.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.22.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.22 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 11:32:09.940Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.