autotel-adapters@3.0.0

Framework adapters and composable DX helpers for autotel

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The inspected source aligns with framework telemetry adapters: environment variables supply adapter configuration, and the new integration code performs request tracing. The manifest and inspected runtime dependencies show no install hook or unrelated attack behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Importing an adapter exposes its API; configuration is resolved when an adapter is used.

Impact

No unrelated data transfer, account action, or system mutation was identified.

Mechanism

The adapter reads configured environment keys and applies request tracing to selected paths, skipping paths excluded by its instrumentation policy.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares framework adapter entrypoints and has no install lifecycle hook.
The adapter reads environment values to resolve caller-defined configuration fields.
The changed integration bundle instruments selected framework requests and skips excluded paths.
The inspected autotel dependencies expose tracing functionality and have no install lifecycle hooks.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 101 KB of source

Source & flagged code

8 flagged

dist/core.cjsView file

Lines 1-22javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

2const require_integration = require("./integration-Danzss1R.cjs");

3let autotel = require("autotel");

4let autotel_edge = require("autotel-edge");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/core.cjsView on unpkg · L2

6//#region src/core.ts

7function createUseLogger(options) {

8 return function useLogger(context, requestLoggerOptions) {

9 let logger;

10 try {

11 logger = (0, autotel.getRequestLogger)(void 0, requestLoggerOptions);

12 } catch {

13 throw new Error(`[autotel-adapters/${options.adapterName}] No active trace context. Wrap your handler with autotel trace instrumentation before calling useLogger().`);

14 }

15 if (context && options.enrich) {

16 const extra = options.enrich(context);

17 if (extra && Object.keys(extra).length > 0) logger.set(extra);

18 }

19 return logger;

20 };

21}

22/**

dist/integration-Danzss1R.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-adapters@2.1.1 matchedIdentity = npm:YXV0b3RlbC1hZGFwdGVycw:2.1.1 similarity = 0.404 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/integration-Danzss1R.cjsView on unpkg

package.jsonView file

Lines 123-151json

123 "optional": true

124 },

125 "nitropack": {

126 "optional": true

127 }

128 },

129 "devDependencies": {

130

.lpm-dependency-evidence-552993f9-eea4-4f75-9e13-931be4c422c5/0/npm-linux/package.jsonView file

680hub.com/jagreehal/autotel#readme", "scripts": { "build": "tsdown", "ci": "npm run build && npm run check-format && npm run check-exports && npm run lint && npm run test", "dev": "tsdown --watch",

Low

Suspicious Lifecycle Evidence