autotel-adapters@2.1.1

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The package and inspected dependencies have no install lifecycle hooks, and the Cloudflare adapter’s runtime dependency bridge supports its stated adapter function. The inspected network code sends telemetry to a request-provided URL; no malicious collection or package-selected recipient was established.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports an adapter or uses its tracing and telemetry functions.

Impact

No confirmed attack surface was established in the inspected source.

Mechanism

The adapter delegates telemetry operations to autotel; inspected exporter code sends requests to the URL carried by its request object.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes framework adapters and lists build, development, type-check, lint, test and clean scripts; it has no install lifecycle hook.
autotel and autotel-edge manifests list development and test scripts, with no install lifecycle hook.
The CommonJS autotel entrypoint loads internal telemetry modules and the OpenTelemetry API.
The telemetry exporter posts to a request URL supplied through its request object; no fixed endpoint appears in the inspected send code.
The autotel-edge entrypoint documents tracing a caller-provided fetch handler and returning its response.
The Cloudflare adapter loads autotel as a runtime dependency and exposes adapter functions; this explains the dependency bridge finding.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 94.6 KB of source

Source & flagged code

8 flagged

dist/cloudflare.cjsView file

Lines 1-23javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require("./integration-rv0DU916.cjs");

3const require_core = require("./core.cjs");

4let autotel = require("autotel");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

6//#region src/cloudflare.ts

7const requestLoggers = /* @__PURE__ */ new WeakMap();

Low

Suspicious Dependency Evidence

The Cloudflare adapter loads autotel as a runtime dependency and exposes adapter functions; this explains the dependency bridge finding.

dist/cloudflare.cjsView on unpkg · L1

8function enrichFromRequest(request) {

9 if (!request) return void 0;

10 let route = "/";

11 if (request.url) try {

12 route = new URL(request.url).pathname;

13 } catch {

14 route = request.url;

15 }

16 const requestId = require_core.getHeader(request.headers, "x-request-id") ?? require_core.getHeader(request.headers, "cf-ray");

17 return {

18 "http.request.method": request.method,

19 "url.full": request.url,

20 "http.route": route,

21 "http.request.id": requestId,

22 "cloudflare.country": request.cf?.country,

23 "cloudflare.colo": request.cf?.colo,

package.jsonView file

Lines 123-151json

123 "optional": true

124 },

125 "nitropack": {

126 "optional": true

127 }

128 },

129 "devDependencies": {

130

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/package.jsonView file

682"scripts": { "build": "tsdown", "ci": "npm run build && npm run check-format && npm run check-exports && npm run lint && npm run test", "dev": "tsdown --watch", "li

Low

Suspicious Lifecycle Evidence

autotel and autotel-edge manifests list development and test scripts, with no install lifecycle hook.

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/package.jsonView on unpkg · L682

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/dist/index.cjsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_rolldown_runtime = require("./rolldown-runtime-AN5ru5iW.cjs"); const require_init = require("./init-s2EddUSj.cjs"); const require_val

Low

Ai Review Evidence

The CommonJS autotel entrypoint loads internal telemetry modules and the OpenTelemetry API.

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/dist/index.cjsView on unpkg · L1

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/dist/index.jsView file

461er = new AbortController(); const timeout = setTimeout(() => controller.abort(), timeoutMs); timeout.unref?.(); try { const response = await fetch(request.url, { method: "POST",

Low

Ai Review Evidence

The telemetry exporter posts to a request URL supplied through its request object; no fixed endpoint appears in the inspected send code.

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/dist/index.jsView on unpkg · L461

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/1/npm-linux/package.jsonView file

83"scripts": { "build": "tsdown", "dev": "tsdown --watch", "lint": "oxlint -c oxlint.json --disable-nested-config src", "lint:fix": "pnpm lint --fix", "type-check

Low

Suspicious Lifecycle Evidence

autotel and autotel-edge manifests list development and test scripts, with no install lifecycle hook.

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/1/npm-linux/package.jsonView on unpkg · L83

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/1/npm-linux/dist/index.jsView file

362er = trace(async function fetch(req: Request) { * getActiveTraceContext()?.setAttribute('http.request.method', req.method); * return fetch(req); * }); * ``` */ function getActi

Low

Ai Review Evidence

The autotel-edge entrypoint documents tracing a caller-provided fetch handler and returning its response.

.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/1/npm-linux/dist/index.jsView on unpkg · L362

Source & flagged code

8 flagged · loading source

dist/cloudflare.cjsView file

3package = autotel-adapters; repositoryIdentity = autotel; dependency = autotel L3: const require_core = require("./core.cjs"); L4: let autotel = require("autotel"); L5:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cloudflare.cjsView on unpkg · L3

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_integration = require("./integration-rv0DU916.cjs"); const require_core = require("./core.cjs"); let autotel = require("autotel"); //#region src/cloudflare.ts con

Low

Suspicious Dependency Evidence

The Cloudflare adapter loads autotel as a runtime dependency and exposes adapter functions; this explains the dependency bridge finding.

dist/cloudflare.cjsView on unpkg · L1

package.jsonView file

143"scripts": { "build": "tsdown", "dev": "tsdown --watch", "type-check": "tsc --noEmit", "lint": "oxlint -c oxlint.json --disable-nested-config src", "test": "vit

Findings

1 High2 Medium9 Low

HighCopied Package Dependency Bridgedist/cloudflare.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/package.json

LowAi Review Evidence.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/dist/index.cjs

LowAi Review Evidence.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/0/npm-linux/dist/index.js

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/1/npm-linux/package.json

LowAi Review Evidence.lpm-dependency-evidence-e68cfbb6-ad90-4fe6-b276-00739f8f4c1b/1/npm-linux/dist/index.js

Affected versions and remediation

This report applies to autotel-adapters@2.1.1.

See all versions of autotel-adapters for other recorded verdicts.

Review the evidence and your use of autotel-adapters@2.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 08:37:59.220Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.