autotel-vitest@0.4.74

Vitest fixture for OpenTelemetry: one span per test so all instrumented code is filterable by test run

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The reviewed package entrypoints implement test-span collection and reporting, while the dependency’s network drain uses a supplied request destination. The manifests show no install lifecycle hooks, and the inspected source establishes no concrete attack behavior.

Static reason

No blocking static signals were detected.

Trigger

Loading the fixture or reporter and running Vitest tests.

Impact

No unauthorized transfer, destructive change, or persistence was identified.

Mechanism

The fixture records test spans, flushes the telemetry provider, and attaches collected spans to Vitest task metadata.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.
The inspected autotel dependency manifest lists build and test scripts, with no install lifecycle hook.
The fixture creates a span for each test, flushes it, and places collected spans in Vitest task metadata; the reporter records test and suite spans.
The dependency POSTs a supplied request URL, headers and body; no fixed recipient appears in that code.
The supporting collector and testing modules record spans in memory and expose OpenTelemetry processors.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 16.4 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-63json

2 "name": "autotel-vitest",

3 "version": "0.4.74",

4 "description": "Vitest fixture for OpenTelemetry: one span per test so all instrumented code is filterable by test run",

5 "license": "Apache-2.0",

6 "type": "module",

7 "main": "./dist/index.js",

8 "types": "./dist/index.d.ts",

9 "sideEffects": false,

10 "exports": {

11 ".": {

12 "types": "./dist/index.d.ts",

13 "import": "./dist/index.js",

14 "require": "./dist/index.cjs"

15 },

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L7

16 "./reporter": {

17 "types": "./dist/reporter.d.ts",

18 "import": "./dist/reporter.js",

19 "require": "./dist/reporter.cjs"

20 }

21 },

22 "files": [

23 "dist",

24 "README.md",

25 "LICENSE",

26 "NOTICE"

27 ],

28 "dependencies": {

29 "autotel": "8.4.1"

30 },

31 "peerDependencies": {

32 "vitest": ">=5.0.5"

33 },

34 "peerDependenciesMeta": {

35 "vitest": {

36 "optional": false

37 }

38 },

39 "devDependencies": {

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L28

40 "@types/node": "^26.6.5",

41 "executable-stories-formatters": "1.27.0",

42 "executable-stories-vitest": "8.11.1",

43 "tsdown": "^0.23.1",

44 "typescript": "^7.0.2",

45 "vitest": "^5.0.5"

46 },

47 "repository": {

48 "type": "git",

49 "url": "https://github.com/jagreehal/autotel",

50 "directory": "packages/autotel-vitest"

51 },

52 "scripts": {

53 "build": "tsdown",

54 "dev": "tsdown --watch",

55 "type-check": "tsc --noEmit",

56 "test": "vitest run",

57 "test:compat": "vitest run --config integration/vitest.config.ts",

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L52

58 "test:stories": "vitest run --config vitest.stories.config.ts",

59 "test:watch": "vitest",

60 "lint": "oxlint -c oxlint.json --disable-nested-config src",

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L56

61 "clean": "rimraf dist"

62 }

63}

.lpm-dependency-evidence-40b35b50-d507-4e28-8093-b634cb299504/0/npm-linux/package.jsonView file

682"scripts": { "build": "tsdown", "ci": "npm run build && npm run check-format && npm run check-exports && npm run lint && npm run test", "dev": "tsdown --watch", "lint": "oxlint -c oxlint.json --disable-nested-config src", "lint:fix": "pnpm lint --fix", "format:check": "prettier --check src/**/*.ts", "type-check": "tsc --noEmit", "test": "vitest run --config vitest.unit.config.ts", "test:watch": "vitest --config vitest.unit.config.ts", "test:integration": "vitest run --config vitest.integration.config.ts", "test:integration:watch": "vitest --config

Low

Suspicious Lifecycle Evidence

The inspected autotel dependency manifest lists build and test scripts, with no install lifecycle hook.

.lpm-dependency-evidence-40b35b50-d507-4e28-8093-b634cb299504/0/npm-linux/package.jsonView on unpkg · L682

694"test:e2e": "vitest run --config vitest.e2e.config.ts", "test:all": "pnpm test && pnpm test:integration", "check-format": "prettier --check ./src", "check-exports": "attw --pack . --ignore-rules no-resolution", "clean": "rimraf dist", "quality": "pnpm type-check && pnpm test && pnpm lint && pnpm format:ch

Low

Suspicious Lifecycle Evidence

The inspected autotel dependency manifest lists build and test scripts, with no install lifecycle hook.

.lpm-dependency-evidence-40b35b50-d507-4e28-8093-b634cb299504/0/npm-linux/package.jsonView on unpkg · L694

dist/index.jsView file

Lines 56-96javascript

56 return otelTestCollector;

57}

58//#endregion

59//#region src/index.ts

60/**

61* autotel-vitest

62*

63* Vitest fixture that creates one OTel span per test so all autotel-instrumented

64* code executed during a test automatically creates child spans under it;

65* making every test run filterable in your OTLP backend.

dist/reporter.jsView file

Lines 1-38javascript

1import { SpanStatusCode, getTracer } from "autotel";

2//#region src/reporter.ts

3const TRACER_NAME = "vitest-reporter";

4const TRACER_VERSION = "0.1.0";

Source & flagged code

8 flagged · loading source

package.jsonView file

28"dependencies": { "autotel": "8.4.1" }, "peerDependencies": { "vitest": ">=5.0.5" }, "peerDependenciesMeta": { "vitest": { "optional": false } },

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L28

52"scripts": { "build": "tsdown", "dev": "tsdown --watch", "type-check": "tsc --noEmit", "test": "vitest run", "test:compat": "vitest run --

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L52

7"main": "./dist/index.js", "types": "./dist/index.d.ts", "sideEffects": false, "exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js", "require": "./dist/index.cjs"

Low

Ai Review Evidence

The manifest exposes Vitest fixture and reporter entrypoints and depends on autotel 8.4.1; its scripts are build, test and maintenance commands.

package.jsonView on unpkg · L7

Findings

9 Low

LowScripts Present

LowAi Review Evidencepackage.json

LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-40b35b50-d507-4e28-8093-b634cb299504/0/npm-linux/package.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/reporter.js

Affected versions and remediation

This report applies to autotel-vitest@0.4.74.

See all versions of autotel-vitest for other recorded verdicts.

Review the evidence and your use of autotel-vitest@0.4.74 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 08:37:20.190Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.