registry / autotel-devtools / 31.3.0

autotel-devtools@31.3.0

⚠ Under review

Standalone OTLP receiver with web UI for local development

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 1.80 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.devin.ai, devtools.local, events.pagerduty.com, fonts.googleapis.com, github.com, svelte.dev, tailwindcss.com, www.w3.org

Source & flagged code

3 flagged

dist/http-DnhE5AhG.jsView file

Lines 1-27javascript

1import { i as encodeTraces } from "./wire-2Rmfg6IT.js";

2import { a as firesOn, i as redactDestination, l as occurrenceFromLog, n as deliver, s as summarize$1, u as occurrenceFromTrace } from "./issues-CCyP4qx9.js";

3import { n as readSourceWindow, t as createSourceMapResolver } from "./sourcemap-tAJD0QWW.js";

4import { i as asString, n as asBoolean, r as asNumber, t as asObject } from "./json-fields-DRnnBsZ2.js";

5import { t as pickRoot } from "./trace-root-EHnvuA7f.js";

6import { a as compileWhere, t as parse } from "./parse-CCZIhG-D.js";

7import { t as getResourceName } from "./resource-utils-B4UVvfnH.js";

8import { createServer } from "node:http";

9import { WebSocket, WebSocketServer } from "ws";

10import { spawn } from "node:child_process";

11import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync } from "node:fs";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/http-DnhE5AhG.jsView on unpkg · L7

12import { createServer as createServer$1 } from "node:net";

13import { delimiter, dirname, join, relative, resolve } from "node:path";

14import { Client, credentials } from "@grpc/grpc-js";

15import protobuf from "protobufjs";

16import { AGENT_KINDS, ingestAgentEvents, ingestAgentMetrics, usageReport } from "autotel-agents";

17import { DatabaseSync } from "node:sqlite";

18import { createHash, randomUUID } from "node:crypto";

19import { gzipSync } from "node:zlib";

20import { fileURLToPath } from "node:url";

22//#region src/server/otlp-proto.ts

23const COMMON_PROTO = `

24syntax = "proto3";

25package opentelemetry.proto.common.v1;

27message AnyValue {

dist/issues-CCyP4qx9.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/issues-CCyP4qx9.js#virtual:normalized:round1View on unpkg

dist/http-DzC40CME.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-devtools@30.0.0 matchedIdentity = npm:YXV0b3RlbC1kZXZ0b29scw:30.0.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/http-DzC40CME.cjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/http-DnhE5AhG.jsView file

7import { t as getResourceName } from "./resource-utils-B4UVvfnH.js"; L8: import { createServer } from "node:http"; L9: import { WebSocket, WebSocketServer } from "ws"; L10: import { spawn } from "node:child_process"; L11: import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync } from "node:fs"; ... L358: ]); L359: function idsToBase64(value) { L360: if (Array.isArray(value)) return value.map(idsToBase64); ... L384: /** `AUTOTEL_WEAVER_BIN`, else the first executable `weaver` on PATH. */ L385: function resolveWeaver(env = process.env) { L386: const custom = env.AUTOTEL_WEAVER_BIN?.trim(); L387: if (custom) return custom;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/http-DnhE5AhG.jsView on unpkg · L7

dist/issues-CCyP4qx9.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/issues-CCyP4qx9.js#virtual:normalized:round1View on unpkg

Findings

2 High2 Medium5 Low

HighSemantic Analysis Limiteddist/issues-CCyP4qx9.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/http-DzC40CME.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/http-DnhE5AhG.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to autotel-devtools@31.3.0.

See all versions of autotel-devtools for other recorded verdicts.

Review the evidence and your use of autotel-devtools@31.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:50:27.993Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.