registry / autotel-adapters / 2.0.29

autotel-adapters@2.0.29

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook and ties the Cloudflare entrypoint to the package’s own adapter bundle. The flagged dependency bridge resolves to declared dependencies and local modules, and the inspected runtime code performs request tracing and logging rather than a concrete attack.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports and invokes the Cloudflare adapter with a request handler.

Impact

Request instrumentation and logging; inspected source showed no package-directed network transfer or install-time execution.

Mechanism

The adapter creates tracing context, enriches request logging, and invokes the supplied handler through the integration layer.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies the package and maps its Cloudflare export to the inspected dist bundle.
The manifest declares autotel and autotel-edge dependencies; the Cloudflare bundle requires those package dependencies and local integration/core modules.
The manifest scripts are build, development, type-check, lint, test, and clean tasks; no install lifecycle hook is declared.
The Cloudflare adapter wraps a caller-provided handler in request tracing, while core logging requires an active trace context.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 88.8 KB of source

Source & flagged code

9 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require("./integration-rv0DU916.cjs");

3const require_core = require("./core.cjs");

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

Low

Suspicious Dependency Evidence

The manifest declares autotel and autotel-edge dependencies; the Cloudflare bundle requires those package dependencies and local integration/core modules.

dist/cloudflare.cjsView on unpkg · L1

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Lines 45-85javascript

45}

46function createIntegration() {

47 return require_integration.defineFrameworkIntegration({

48 name: "cloudflare",

49 extractRequest: ({ request }) => ({

50 method: request.method ?? "GET",

package.jsonView file

Lines 1-61json

2 "name": "autotel-adapters",

3 "version": "2.0.29",

4 "description": "Framework adapters and composable DX helpers for autotel",

5 "license": "Apache-2.0",

dist/core.jsView file

Lines 1-25javascript

1import { d as mergeRequestLoggerOptions, f as shouldInstrumentPath, o as toRouteAdapterOptions } from "./integration-jKj-jgtX.js";

2import { getRequestLogger, trace } from "autotel";

4//#region src/core.ts

5function createUseLogger

dist/integration-rv0DU916.cjsView file

1const require_toolkit_storage = require("./toolkit/storage.cjs"); let autotel = require("autotel"); let autotel_edge = require("autotel-edge"); //#region src/toolkit/deferred-drain.ts /** * Extend drain lifetime on serverless runtimes with

Low

Suspicious Dependency Evidence

The manifest declares autotel and autotel-edge dependencies; the Cloudflare bundle requires those package dependencies and local integration/core modules.

dist/integration-rv0DU916.cjsView on unpkg · L1

Source & flagged code

9 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require("./core.cjs"); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_integration = require("./integration-rv0DU916.cjs"); const require_core = require("./core.cjs"); let autotel = require("autotel"); //#region src/cloudflare.ts const request

Low

Suspicious Dependency Evidence

The manifest declares autotel and autotel-edge dependencies; the Cloudflare bundle requires those package dependencies and local integration/core modules.

dist/cloudflare.cjsView on unpkg · L1

65if (typeof options?.spanName === "function") return options.spanName(request, env); return options?.spanName ?? `cloudflare.${request.method ?? "request"}`; } function withAutotelFetch(handler, options) { return async (request, env, executionContext) => { const ctx = { request, env, executionContext }; try { return await integration.runTraced(ctx, require_integration.buildTracedOptions(options, resolveSpanName(request, env, options)), async (handle) => require_inte

Findings

1 High2 Medium9 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowAi Review Evidencepackage.json

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/core.js

LowAi Review Evidencedist/cloudflare.cjs

LowSuspicious Dependency Evidencedist/integration-rv0DU916.cjs

Affected versions and remediation

This report applies to autotel-adapters@2.0.29.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 11:03:35.056Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.