registry / autotel-adapters / 2.0.27

autotel-adapters@2.0.27

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The manifest contains no install lifecycle hooks, and the inspected Cloudflare module implements request adapter behavior using declared dependencies. The scanner signals do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports and calls the Cloudflare adapter.

Impact

No malicious effect was established from the inspected source.

Mechanism

The adapter extracts request information, runs the handler through tracing integration, and uses the platform execution context when available.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the package through dist/index.js and declares sideEffects false.
package.json declares autotel and autotel-edge as runtime dependencies; its scripts are build, development, type-check, lint, test, and clean tasks.
dist/cloudflare.cjs imports local adapter modules and the declared autotel dependency.
dist/cloudflare.cjs defines a Cloudflare framework integration that uses the platform execution context.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.3 KB of source

Source & flagged code

6 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-DfduKDZQ.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

Low

Suspicious Dependency Evidence

dist/cloudflare.cjs imports local adapter modules and the declared autotel dependency.

dist/cloudflare.cjsView on unpkg · L2

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 38-78javascript

38function resolvePath(request) {

39 if (!request.url) return "/";

40 try {

41 return new URL(request.url).pathname;

42 } catch

package.jsonView file

Lines 1-27json

2 "name": "autotel-adapters",

3 "version": "2.0.27",

4 "description": "Framework adapters and composable DX helpers for autotel",

5 "license": "Apache-2.0",

Source & flagged code

6 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

2require('./integration-DfduKDZQ.cjs'); const require_core = require('./core.cjs'); let autotel = require("autotel"); //#region src/cloudflare.ts const

Low

Suspicious Dependency Evidence

dist/cloudflare.cjs imports local adapter modules and the declared autotel dependency.

dist/cloudflare.cjsView on unpkg · L2

58extractWaitUntil: ({ executionContext }) => { return typeof executionContext.waitUntil === "function" ? executionContext.waitUntil.bind(executionContext) : void 0; } }); } const integration = createIntegration(); function resolveSpanName(request, env, options) { if (typeof options?.spanName === "function"

Low

Ai Review Evidence

dist/cloudflare.cjs defines a Cloudflare framework integration that uses the platform execution context.

Findings

1 High2 Medium6 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowAi Review Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/cloudflare.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.27.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.27 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 10:39:12.920Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.