registry / autotel-adapters / 2.0.30

autotel-adapters@2.0.30

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest and inspected runtime code are consistent with framework logging adapters and show no install hook or concrete attack behavior. The flagged Cloudflare dependency bridge resolves to local adapter modules and declared dependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer invokes an exported framework adapter or configuration helper.

Impact

No credential transfer, unrelated account action, or other concrete attack effect was established.

Mechanism

The inspected code calls the supplied handler within tracing and reads configured environment values for adapter settings.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares the autotel and autotel-edge dependencies, plus framework peers, matching the package’s adapter role.
The Cloudflare bundle imports local integration and core modules and the declared autotel dependency.
The Cloudflare adapter enriches request logs with request method, URL, route, request ID, and Cloudflare location metadata.
The manifest scripts contain build, development, type-check, lint, test, and clean commands; no lifecycle hook is declared.

Evidence against

The scanner’s dependency-bridge concern is explained by local adapter imports and the declared autotel dependency.
The reviewed source shows request logging and configuration lookup; no concrete attack behavior was identified.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 88.8 KB of source

Source & flagged code

6 flagged

dist/cloudflare.cjsView file

Lines 1-36javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require("./integration-rv0DU916.cjs");

3const require_core = require("./core.cjs");

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

Low

Suspicious Dependency Evidence

The Cloudflare bundle imports local integration and core modules and the declared autotel dependency.

dist/cloudflare.cjsView on unpkg · L2

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

Low

Ai Review Evidence

The Cloudflare adapter enriches request logs with request method, URL, route, request ID, and Cloudflare location metadata.

dist/cloudflare.cjsView on unpkg · L16

24 "cloudflare.city": request.cf?.city

25 };

26}

27const baseUseLogger = require_core.createUseLogger({

28 adapterName: "cloudflare",

29 enrich: enrichFromRequest

30});

31function useLogger(request, requestLoggerOptions) {

32 if (request) {

33 const existing = requestLoggers.get(request);

34 if (existing) return existing;

35 }

36 return baseUseLogger(request, requestLoggerOptions);

package.jsonView file

Lines 68-146json

68 "import": "./dist/nestjs.js",

69 "require": "./dist/nestjs.cjs"

70 },

71 "./sveltekit": {

72 "types": "./dist/sveltekit.d.ts",

73 "import":

dist/core.jsView file

Lines 19-59javascript

19}

20/**

21* Build a request runner bound to one framework's logger storage. The returned

22* function opens a span, creates a request logger, runs `handler` inside the

23* storage so `useLogger()` resolves it, records thrown errors, and emits one

24* wide event when the handler settles (unless `autoEmit` is `false`).

25*/

26function createRequestRunner(storage) {

Source & flagged code

6 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require("./core.cjs"); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

2require("./integration-rv0DU916.cjs"); const require_core = require("./core.cjs"); let autotel = require("autotel"); //#region src/cloudflare.ts const requestLoggers = /* @__PURE

Low

Suspicious Dependency Evidence

The Cloudflare bundle imports local integration and core modules and the declared autotel dependency.

dist/cloudflare.cjsView on unpkg · L2

16-request-id") ?? require_core.getHeader(request.headers, "cf-ray"); return { "http.request.method": request.method, "url.full": request.url, "http.route": route, "http.request.id": requestId, "cloudflare.country": request.cf?.country, "c

Low

Ai Review Evidence

The Cloudflare adapter enriches request logs with request method, URL, route, request ID, and Cloudflare location metadata.

Findings

1 High2 Medium6 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/cloudflare.cjs

LowAi Review Evidencedist/core.js

Affected versions and remediation

This report applies to autotel-adapters@2.0.30.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.0.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 20:36:56.123Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.