registry / autotel-adapters / 2.0.26

autotel-adapters@2.0.26

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The manifest contains no install lifecycle hooks, and the inspected adapter code implements request tracing using local modules and a declared dependency. The scanner’s copied dependency-bridge hint is consistent with those imports, and no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package entrypoint or invoking an exported adapter helper.

Impact

No harmful effect or malicious behavior was established from the inspected source.

Mechanism

The adapter loads its framework integration, core helpers, and declared autotel dependency, then derives tracing data from the incoming request.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies a framework-adapter package with ordinary runtime dependencies; no install lifecycle hook appears in its scripts.
dist/cloudflare.cjs imports its bundled integration/core modules and the declared autotel dependency.
The Cloudflare adapter derives request metadata and exposes tracing/logger helpers; this is consistent with framework instrumentation.
The package repository metadata points to the autotel-adapters workspace directory.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.3 KB of source

Source & flagged code

5 flagged

dist/cloudflare.cjsView file

Lines 1-41javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-DfduKDZQ.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

Low

Suspicious Dependency Evidence

dist/cloudflare.cjs imports its bundled integration/core modules and the declared autotel dependency.

dist/cloudflare.cjsView on unpkg · L1

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

24 "cloudflare.city": request.cf?.city

25 };

26}

27const baseUseLogger = require_core.createUseLogger({

28 adapterName: "cloudflare",

29 enrich: enrichFromRequest

Low

Ai Review Evidence

The Cloudflare adapter derives request metadata and exposes tracing/logger helpers; this is consistent with framework instrumentation.

dist/cloudflare.cjsView on unpkg · L21

30});

31function useLogger(request, requestLoggerOptions) {

32 if (request) {

33 const existing = requestLoggers.get(request);

34 if (existing) return existing;

35 }

36 return baseUseLogger(request, requestLoggerOptions);

37}

38function resolvePath(request) {

39 if (!request.url) return "/";

40 try {

41 return new URL(request.url).pathname;

package.jsonView file

Lines 68-146json

68 "import": "./dist/nestjs.js",

69 "require": "./dist/nestjs.cjs"

70 },

71 "./sveltekit": {

72 "types": "./dist/sveltekit.d.ts",

73 "import":

Source & flagged code

5 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_integration = require('./integration-DfduKDZQ.cjs'); const require_core = require('./core.cjs'); let autotel = require("autotel"); /

Low

Suspicious Dependency Evidence

dist/cloudflare.cjs imports its bundled integration/core modules and the declared autotel dependency.

dist/cloudflare.cjsView on unpkg · L1

21"cloudflare.country": request.cf?.country, "cloudflare.colo": request.cf?.colo, "cloudflare.city": request.cf?.city }; } const baseUseLogger = require_core.createUseLogger({ adapterName: "cloudflare", enrich: e

Low

Ai Review Evidence

The Cloudflare adapter derives request metadata and exposes tracing/logger helpers; this is consistent with framework instrumentation.

Findings

1 High2 Medium5 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to autotel-adapters@2.0.26.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.26 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 19:53:25.610Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.