autotel-web@2.2.1

⚠ Under review

Ultra-lightweight browser SDK for distributed tracing - propagates W3C traceparent headers to backends using Autotel (~2-5KB gzipped)

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 4 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 125 KB of source

Source & flagged code

2 flagged

dist/full.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/full.js#virtual:normalized:round1View on unpkg

dist/full.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = autotel-web@2.1.0 matchedIdentity = npm:YXV0b3RlbC13ZWI:2.1.0 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/full.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/full.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/full.js#virtual:normalized:round1View on unpkg

dist/full.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/full.jsView on unpkg

Findings

2 High1 Medium1 Low

HighSemantic Analysis Limiteddist/full.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/full.js

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to autotel-web@2.2.1.

See all versions of autotel-web for other recorded verdicts.

Review the evidence and your use of autotel-web@2.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 09:11:26.238Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.