registry / autotel-adapters / 2.0.28

autotel-adapters@2.0.28

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The inspected entrypoint and Cloudflare adapter implement framework tracing and request enrichment, while the manifest declares their runtime dependencies and has no install lifecycle hook. The scanner's dependency bridge finding is consistent with this adapter behavior; no malicious action was identified.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the Cloudflare adapter or invoking its exported handler wrapper.

Impact

No malicious effect or confirmed attack surface was established.

Mechanism

The adapter extracts request metadata and runs the caller-provided handler through tracing integration code.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies this as a framework adapter package and selects dist/index.js as its main entry.
package.json declares autotel and autotel-edge as runtime dependencies; the Cloudflare entry imports the declared autotel package and local adapter modules.
The Cloudflare adapter derives request metadata and runs the supplied handler through tracing integration code.
The package scripts contain build, development, checking, lint, test, and cleanup commands; no install lifecycle hook is present.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 86.3 KB of source

Source & flagged code

6 flagged

dist/cloudflare.cjsView file

Lines 1-27javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require('./integration-DfduKDZQ.cjs');

3const require_core = require('./core.cjs');

4let autotel = require("autotel");

Low

Suspicious Dependency Evidence

package.json declares autotel and autotel-edge as runtime dependencies; the Cloudflare entry imports the declared autotel package and local adapter modules.

dist/cloudflare.cjsView on unpkg · L1

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

Low

Ai Review Evidence

The Cloudflare adapter derives request metadata and runs the supplied handler through tracing integration code.

dist/cloudflare.cjsView on unpkg · L7

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

24 "cloudflare.city": request.cf?.city

25 };

26}

27const baseUseLogger = require_core.createUseLogger({

package.jsonView file

Lines 1-21json

2 "name": "autotel-adapters",

3 "version": "2.0.28",

4 "description": "Framework adapters and composable DX helpers for autotel",

5 "license": "Apache-2.0",

Source & flagged code

6 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require('./core.cjs'); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_integration = require('./integration-DfduKDZQ.cjs'); const require_core = require('./core.cjs'); let autotel = require

Low

Suspicious Dependency Evidence

package.json declares autotel and autotel-edge as runtime dependencies; the Cloudflare entry imports the declared autotel package and local adapter modules.

dist/cloudflare.cjsView on unpkg · L1

7const requestLoggers = /* @__PURE__ */ new WeakMap(); function enrichFromRequest(request) { if (!request) return void 0; let route = "/"; if (request.url) try { route = new URL(request.url).pathname; } catch { route = request.url; } const r

Low

Ai Review Evidence

The Cloudflare adapter derives request metadata and runs the supplied handler through tracing integration code.

Findings

1 High2 Medium6 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowAi Review Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/cloudflare.cjs

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to autotel-adapters@2.0.28.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 14:27:29.131Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.