registry / autotel-devtools / 31.1.1

autotel-devtools@31.1.1

⚠ Under review

Standalone OTLP receiver with web UI for local development

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 1.74 MB of source, external domains: api.anthropic.com, api.devin.ai, devtools.local, events.pagerduty.com, fonts.googleapis.com, svelte.dev, tailwindcss.com, www.w3.org

Source & flagged code

3 flagged

dist/http-CX4A0S6d.jsView file

Lines 1-27javascript

1import { i as encodeTraces } from "./wire-2Rmfg6IT.js";

2import { a as firesOn, i as redactDestination, l as occurrenceFromLog, n as deliver, s as summarize$1, u as occurrenceFromTrace } from "./issues-CCyP4qx9.js";

3import { n as readSourceWindow, t as createSourceMapResolver } from "./sourcemap-tAJD0QWW.js";

4import { i as asString, n as asBoolean, r as asNumber, t as asObject } from "./json-fields-DRnnBsZ2.js";

5import { t as pickRoot } from "./trace-root-EHnvuA7f.js";

6import { a as compileWhere, t as parse } from "./parse-CCZIhG-D.js";

7import { t as getResourceName } from "./resource-utils-B4UVvfnH.js";

8import { createServer } from "node:http";

9import { WebSocket, WebSocketServer } from "ws";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/http-CX4A0S6d.jsView on unpkg · L7

10import { existsSync, readFileSync } from "node:fs";

11import { dirname, resolve } from "node:path";

12import { ingestAgentEvents, ingestAgentMetrics } from "autotel-agents";

13import { DatabaseSync } from "node:sqlite";

14import { createHash, randomUUID } from "node:crypto";

15import { gzipSync } from "node:zlib";

16import { fileURLToPath } from "node:url";

17import protobuf from "protobufjs";

19//#region src/server/issue-input.ts

20function serviceOf(span, trace) {

21 const own = span.attributes["service.name"];

22 return typeof own === "string" && own !== "" ? own : trace.service;

23}

24function traceToIssueSpans(trace) {

25 return trace.spans.map((span) => ({

26 spanId: span.spanId,

27 parentSpanId: span.parentSpanId,

dist/issues-CCyP4qx9.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/issues-CCyP4qx9.js#virtual:normalized:round1View on unpkg

dist/cli.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-devtools@30.0.0 matchedIdentity = npm:YXV0b3RlbC1kZXZ0b29scw:30.0.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/http-CX4A0S6d.jsView file

7import { t as getResourceName } from "./resource-utils-B4UVvfnH.js"; L8: import { createServer } from "node:http"; L9: import { WebSocket, WebSocketServer } from "ws"; ... L43: severityNumber: log.severityNumber, L44: body: typeof log.body === "string" ? log.body : JSON.stringify(log.body), L45: timestamp: log.timestamp, ... L256: const key = stackKeyOf(holder); L257: if (holder && key) holder[key] = resolver.resolveStack(String(holder[key])); L258: } ... L573: function resolveTelemetryLimits(args = {}) { L574: const env = args.env ?? process.env; L575: const fallback = args.maxHistory ?? defaultLimit;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/http-CX4A0S6d.jsView on unpkg · L7

dist/issues-CCyP4qx9.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/issues-CCyP4qx9.js#virtual:normalized:round1View on unpkg

Findings

2 High2 Medium5 Low

HighSemantic Analysis Limiteddist/issues-CCyP4qx9.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/cli.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/http-CX4A0S6d.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to autotel-devtools@31.1.1.

See all versions of autotel-devtools for other recorded verdicts.

Review the evidence and your use of autotel-devtools@31.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-05 14:54:14.076Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.