autotel-cloudflare@18.2.8
The #1 OpenTelemetry package for Cloudflare Workers - complete bindings coverage, native CF OTel integration, advanced sampling
AI Security Review
scanned 2d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or independent attack behavior. The new bundle's network-related code instruments consumer-invoked Cloudflare binding calls and forwards them to the same binding.
Decision evidence
public snapshot- The package manifest lists build, development, lint, type-check, test, and cleanup scripts, with OpenTelemetry runtime dependencies; no installation lifecycle hook appears.
- The prepared OpenTelemetry dependency manifests and entrypoints expose tracing and resource APIs, with ordinary development scripts and no indicated install hook.
- The flagged bundle wraps a consumer-provided Cloudflare service binding and forwards its request to that same binding; the main entrypoint exposes consumer-facing instrumentation.
Source & flagged code
9 flagged · loading sourceThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bindings-BrIFnhtD.jsView on unpkgThe package manifest lists build, development, lint, type-check, test, and cleanup scripts, with OpenTelemetry runtime dependencies; no installation lifecycle hook appears.
package.jsonView on unpkg · L80Findings
Affected versions and remediation
This report applies to autotel-cloudflare@18.2.8.
See all versions of autotel-cloudflare for other recorded verdicts.
- Review the evidence and your use of autotel-cloudflare@18.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.