autotel-audit@1.2.10

Audit-focused helpers for Autotel (force-keep + structured audit instrumentation)

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The package exposes caller-invoked audit instrumentation and has no install lifecycle hook. The inspected dependency manifests and entrypoint/schema files show no concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

The package has no install lifecycle hook; its audit helpers run when called by a consumer.

Impact

No attack impact was established from the inspected source.

Mechanism

The reviewed helper records supplied audit metadata in the active trace and logger. No automatic collection or network transfer was found.

AI rationale

The package exposes caller-invoked audit instrumentation and has no install lifecycle hook. The inspected dependency manifests and entrypoint/schema files show no concrete malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points to the dist entrypoints, pins autotel 8.5.0, and lists only build, development, lint, type-check, and test scripts; no lifecycle hook is declared.
The inspected autotel manifest lists build and quality scripts, with no install lifecycle hook.
The dependency entrypoints load internal instrumentation modules, and their security schemas define event attributes and severity values.
securityEvent records caller-provided metadata on a trace and logger; no automatic network send or host-data collection was identified in the reviewed entrypoint.

Evidence against

Behavioral surface

Source

Crypto

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 45.6 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-56json

2 "name": "autotel-audit",

3 "version": "1.2.10",

4 "description": "Audit-focused helpers for Autotel (force-keep + structured audit instrumentation)",

5 "type": "module",

6 "main": "./dist/index.js",

7 "types": "./dist/index.d.ts",

8 "sideEffects": false,

9 "exports": {

10 ".": {

11 "types": "./dist/index.d.ts",

Low

Suspicious Lifecycle Evidence

package.json points to the dist entrypoints, pins autotel 8.5.0, and lists only build, development, lint, type-check, and test scripts; no lifecycle hook is declared.

package.jsonView on unpkg · L5

12 "import": "./dist/index.js",

13 "require": "./dist/index.cjs"

14 }

15 },

16 "files": [

17 "dist",

18 "README.md",

19 "LICENSE",

20 "NOTICE"

21 ],

22 "keywords": [

23 "autotel",

24 "audit",

25 "compliance",

26 "opentelemetry",

27 "tail-sampling"

28 ],

29 "author": "Jag Reehal <jag@jagreehal.com> (https://jagreehal.com)",

30 "license": "Apache-2.0",

31 "dependencies": {

32 "autotel": "8.5.0"

33 },

34 "devDependencies": {

35 "@types/node": "^26.6.5",

36 "tsdown": "^0.23.1",

37 "typescript": "^7.0.2",

38 "vitest": "^5.0.5"

39 },

40 "repository": {

41 "type": "git",

42 "url": "https://github.com/jagreehal/autotel",

Low

Suspicious Lifecycle Evidence

package.json points to the dist entrypoints, pins autotel 8.5.0, and lists only build, development, lint, type-check, and test scripts; no lifecycle hook is declared.

package.jsonView on unpkg · L31

43 "directory": "packages/autotel-audit"

44 },

45 "bugs": {

46 "url": "https://github.com/jagreehal/autotel/issues"

47 },

48 "homepage": "https://github.com/jagreehal/autotel#readme",

49 "scripts": {

50 "build": "tsdown",

51 "dev": "tsdown --watch",

52 "lint": "oxlint -c oxlint.json --disable-nested-config src",

53 "type-check": "tsc --noEmit",

54 "test": "vitest run"

55 }

56}

Low

Suspicious Lifecycle Evidence

package.json points to the dist entrypoints, pins autotel 8.5.0, and lists only build, development, lint, type-check, and test scripts; no lifecycle hook is declared.

package.jsonView on unpkg · L49

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/package.jsonView file

681"scripts": { "build": "tsdown", "ci": "npm run build && npm run check-format && npm run check-exports && npm run lint && npm run test", "dev": "tsdown --watch", "lint": "oxlint -c oxlint.json --disable-nested-config src", "lint:fix": "pnpm lint --fix", "format:check": "prettier --check src/**/*.ts", "type-check": "tsc --noEmit", "test": "vitest run --config vitest.unit.config.ts", "test:watch": "vitest --config vitest.unit.config.ts", "test:integration": "vitest run --config vitest.integration.config.ts", "test:integration:watch

Low

Suspicious Lifecycle Evidence

The inspected autotel manifest lists build and quality scripts, with no install lifecycle hook.

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/package.jsonView on unpkg · L681

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/index.cjsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_rolldown_runtime = require("./rolldown-runtime-AN5ru5iW.cjs"); const require_init = require("

Low

Suspicious Dependency Evidence

The dependency entrypoints load internal instrumentation modules, and their security schemas define event attributes and severity values.

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/index.cjsView on unpkg · L1

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/index.jsView file

1import { $ as getEventQueue, A as AUTOTEL_SAMPLING_TAIL_KEEP, B as createLinkFromHeaders, D as AUTOTEL_DEBUG_BAGGAGE_KEY, G as markForceKept, H as extractLinksFromBatch, J as createTraceContext, K as resolveSamplingPreset, L as NeverSampler, M as Alw

Low

Suspicious Dependency Evidence

The dependency entrypoints load internal instrumentation modules, and their security schemas define event attributes and severity values.

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/index.jsView on unpkg · L1

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/security-schema.cjsView file

36const SECURITY_ATTR = { /** Marker set on every span carrying a security event. */ marker: "autotel.security", /** Set when the event was force-kept through tail sampling. */ forceKeep: "autotel.s

Low

Suspicious Dependency Evidence

The dependency entrypoints load internal instrumentation modules, and their security schemas define event attributes and severity values.

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/security-schema.cjsView on unpkg · L36

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/security-schema.jsView file

35const SECURITY_ATTR = { /** Marker set on every span carrying a security event. */ marker: "autotel.security", /** Set when the event was force-kept through tail sampling. */ forceKeep: "autotel.s

Low

Suspicious Dependency Evidence

The dependency entrypoints load internal instrumentation modules, and their security schemas define event attributes and severity values.

.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/security-schema.jsView on unpkg · L35

Source & flagged code

8 flagged · loading source

package.jsonView file

5"type": "module", "main": "./dist/index.js", "types": "./dist/index.d.ts", "sideEffects": false, "exports": { ".": {

Low

Suspicious Lifecycle Evidence

package.json points to the dist entrypoints, pins autotel 8.5.0, and lists only build, development, lint, type-check, and test scripts; no lifecycle hook is declared.

package.jsonView on unpkg · L5

31"dependencies": { "autotel": "8.5.0" }, "devDependencies": { "@types/node": "^26.6.5", "tsdown": "^0.23.1", "typescript": "^7.0.2", "vitest": "^5.0.5" }, "repository": { "type": "git", "url": "https://github.com/jagreehal/autotel", "directory": "packages/autotel-audit" }, "bugs": { "url": "https://github.com/jagreehal/autotel/issues" }, "homepage": "https://github.com/jagreehal/autotel#readme", "scripts": { "build": "tsdown", "dev": "tsdown --watch",

Low

Suspicious Lifecycle Evidence

package.json points to the dist entrypoints, pins autotel 8.5.0, and lists only build, development, lint, type-check, and test scripts; no lifecycle hook is declared.

package.jsonView on unpkg · L31

49"scripts": { "build": "tsdown", "dev": "tsdown --watch", "lint": "oxlint -c oxlint.json --disable-nested-config src", "type-check": "tsc --noEmit", "test": "vitest run" } }

Findings

9 Low

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/package.json

LowSuspicious Dependency Evidence.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/index.cjs

LowSuspicious Dependency Evidence.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/index.js

LowSuspicious Dependency Evidence.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/security-schema.cjs

LowSuspicious Dependency Evidence.lpm-dependency-evidence-c6ec9074-1214-47b8-aec1-f9a046ead81d/0/npm-linux/dist/security-schema.js

Affected versions and remediation

This report applies to autotel-audit@1.2.10.

See all versions of autotel-audit for other recorded verdicts.

Review the evidence and your use of autotel-audit@1.2.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 08:25:21.280Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.