registry / autotel-playwright / 0.5.17

autotel-playwright@0.5.17

Playwright fixture for OpenTelemetry: one span per test and trace context injected into API requests

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected runtime behavior matches the package’s Playwright tracing purpose, and the package and selected dependency manifests show no install lifecycle hooks. The network and environment references support configured tracing and do not establish an attack.

Static reason

No blocking static signals were detected.

Trigger

A consumer imports the fixture and runs a Playwright test; page interception is enabled when an API origin is configured.

Impact

No malicious effect was established from the inspected source.

Mechanism

The fixture injects trace headers into matching requests and leaves other page requests unchanged.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.
The Playwright fixture adds trace headers only to requests matching API origins supplied through environment configuration; other page requests continue without those headers.
The inspected `autotel` dependency manifest lists build, development, and check scripts, with no install lifecycle hook shown.
The dependency’s collector stores spans in memory and serializes them when requested; its processor entrypoints expose OpenTelemetry span processors.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 32.0 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-26json

2 "name": "autotel-playwright",

3 "version": "0.5.17",

4 "description": "Playwright fixture for OpenTelemetry: one span per test and trace context injected into API requests",

5 "license": "Apache-2.0",

6 "type": "module",

7 "main": "./dist/index.js",

8 "types": "./dist/index.d.ts",

9 "sideEffects": false,

10 "exports": {

11 ".": {

12 "types": "./dist/index.d.ts",

13 "import": "./dist/index.js",

Low

Suspicious Lifecycle Evidence

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.

package.jsonView on unpkg · L6

14 "require": "./dist/index.cjs"

15 },

16 "./reporter": {

17 "types": "./dist/reporter.d.ts",

18 "import": "./dist/reporter.js",

19 "require": "./dist/reporter.cjs"

20 },

21 "./session": {

22 "types": "./dist/session.d.ts",

23 "import": "./dist/session.js",

24 "require": "./dist/session.cjs"

25 }

26 },

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/package.jsonView file

682"scripts": { "build": "tsdown", "ci": "npm run build && npm run check-format && npm run check-exports && npm run lint && npm run test", "dev": "tsdown --watch", "lint": "oxlint -c oxlint.json --disable-

Low

Suspicious Lifecycle Evidence

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/package.jsonView on unpkg · L682

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/index.jsView file

1import { $ as getEventQueue, A as AUTOTEL_SAMPLING_TAIL_KEEP, B as createLinkFromHeaders, D as AUTOTEL_DEBUG_BAGGAGE_KEY, G as markForceKept, H as extractLinksFromBatch, J as createTraceCont

Low

Suspicious Lifecycle Evidence

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/index.jsView on unpkg · L1

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/index.cjsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_rolldown_runtime = require("./rolldown-runtime-AN5ru5iW.cjs"); const require_init = require("./init-s2EddUSj.cjs"); const require_val

Low

Suspicious Lifecycle Evidence

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/index.cjsView on unpkg · L1

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/test-span-collector.cjsView file

6/** @see ExportResultCode from @opentelemetry/core */ const ExportResultCode = { SUCCESS: 0, FAILED: 1 }; var TestSpanCollector = class { traces = /* @__PURE__ */ new Map(); export(spans, callback) { for (const span of spans) { con

Low

Suspicious Dependency Evidence

The dependency’s collector stores spans in memory and serializes them when requested; its processor entrypoints expose OpenTelemetry span processors.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/test-span-collector.cjsView on unpkg · L6

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/test-span-collector.jsView file

6const ExportResultCode = { SUCCESS: 0, FAILED: 1 }; var TestSpanCollector = class { traces = /* @__PURE__ */ new Map(); export(spans, callback) { for (const span of spans) { const traceId = span.spanContext().traceId; let list =

Low

Suspicious Dependency Evidence

The dependency’s collector stores spans in memory and serializes them when requested; its processor entrypoints expose OpenTelemetry span processors.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/test-span-collector.jsView on unpkg · L6

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/processors.cjsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); const require_canonical_log_line_processor = require("./canonical-log-line-processor-De1xFO9P.cjs"); let _opentelemetry_sdk_trace_base = require("@

Low

Suspicious Dependency Evidence

The dependency’s collector stores spans in memory and serializes them when requested; its processor entrypoints expose OpenTelemetry span processors.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/processors.cjsView on unpkg · L1

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/processors.jsView file

1import { t as CanonicalLogLineProcessor } from "./canonical-log-line-processor-naZRETyk.js"; import { BatchSpanProcessor, SimpleSpanProcessor } from "@opentelemetry/sdk-trace-base"; export { BatchSpanProcessor, Canonica

Low

Suspicious Dependency Evidence

The dependency’s collector stores spans in memory and serializes them when requested; its processor entrypoints expose OpenTelemetry span processors.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/processors.jsView on unpkg · L1

Source & flagged code

8 flagged · loading source

package.jsonView file

6"type": "module", "main": "./dist/index.js", "types": "./dist/index.d.ts", "sideEffects": false, "exports": { ".": { "types": "./dist/index.d.ts",

Low

Suspicious Lifecycle Evidence

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.

package.jsonView on unpkg · L6

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/package.jsonView file

Low

Suspicious Lifecycle Evidence

The package manifest points to library entrypoints and declares no lifecycle scripts; it depends on `autotel` 8.4.1.

.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/package.jsonView on unpkg · L682

Findings

2 Medium9 Low

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/package.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/index.js

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/index.cjs

LowSuspicious Dependency Evidence.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/test-span-collector.cjs

LowSuspicious Dependency Evidence.lpm-dependency-evidence-26cad993-c1eb-4915-9214-52e58b7dd824/0/npm-linux/dist/test-span-collector.js

LowSuspicious Dependency Evidence

Affected versions and remediation

This report applies to autotel-playwright@0.5.17.

See all versions of autotel-playwright for other recorded verdicts.

Review the evidence and your use of autotel-playwright@0.5.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 08:36:47.980Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.