registry / autotel-backends / 2.14.14

autotel-backends@2.14.14

Vendor backend configurations for Autotel (Honeycomb, Datadog, etc.)

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Source inspection found no install hook or covert runtime behavior. The environment references and credentials are part of caller-invoked telemetry configuration for vendor backends.

Static reason

No blocking static signals were detected.

Trigger

A consumer imports and calls a backend configuration helper.

Impact

No unauthorized collection, disclosure, or system modification was identified.

Mechanism

The helper returns exporter configuration using caller-provided settings; the Datadog helper sets missing telemetry environment defaults when called.

AI rationale

Source inspection found no install hook or covert runtime behavior. The environment references and credentials are part of caller-invoked telemetry configuration for vendor backends.

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes backend configuration helpers and contains no install lifecycle hook; its scripts are for development and quality checks.
The inspected dependencies expose telemetry and logging APIs through their package entrypoints; their inspected manifests and entrypoints show no install-time behavior.
The package entrypoint reexports vendor configuration helpers. Those helpers use caller-provided settings to build telemetry configuration, and the Datadog environment defaults are set only when its configuration helper is called.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 37.4 KB of source, external domains: cloud.langfuse.com, eu.i.posthog.com, logfire-eu.pydantic.dev, logfire-us.pydantic.dev, telemetry.googleapis.com, ui.honeycomb.io, us.cloud.langfuse.com, us.i.posthog.com, www.googleapis.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-21json

2 "name": "autotel-backends",

3 "version": "2.14.14",

4 "description": "Vendor backend configurations for Autotel (Honeycomb, Datadog, etc.)",

5 "type": "module",

6 "main": "./dist/index.js",

Low

Suspicious Lifecycle Evidence

The manifest exposes backend configuration helpers and contains no install lifecycle hook; its scripts are for development and quality checks.

package.jsonView on unpkg · L1

7 "types": "./dist/index.d.ts",

8 "sideEffects": false,

9 "exports": {

10 ".": {

11 "types": "./dist/index.d.ts",

12 "import": "./dist/index.js",

13 "require": "./dist/index.cjs"

14 },

15 "./honeycomb": {

16 "types": "./dist/honeycomb.d.ts",

17 "import": "./dist/honeycomb.js",

18 "require": "./dist/honeycomb.cjs"

19 },

20 "./datadog": {

21 "types": "./dist/datadog.d.ts",

Lines 96-129json

96 "optional": true

97 }

98 },

99 "devDependencies": {

100 "@types/node": "^26.6.5",

101 "tsdown": "^0.23.1",

102 "typescript": "^7.0.2",

.lpm-dependency-evidence-ef12925b-b294-406a-8b4f-cf7ea1db0d72/0/npm-linux/package.jsonView file

1{ "name": "autotel", "version": "8.4.1", "description": "Write Once, Observe Anywhere", "main": "./dist/index.js", "types": "./dist/index.d.ts", "type": "module", "si

Low