registry / @uipath/admin-tool / 1.200.0
@uipath/admin-tool@1.200.0
Manage UiPath admin resources — Identity Server, Resource Catalog Service, Audit Service, VPN Gateway.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or import-time attack behavior. The observed authentication and command registration are consistent with an administrative CLI extension.
Static reason
One or more suspicious static signals were detected.
Trigger
A host application must explicitly import the module and register or invoke its commands.
Impact
No confirmed malicious behavior, persistence, or unconsented data transfer was established.
Mechanism
The code uses an existing login context for service clients; no install-time execution is declared.
AI rationale
Static inspection found no lifecycle hook or import-time attack behavior. The observed authentication and command registration are consistent with an administrative CLI extension.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package declares only a module entrypoint and no lifecycle scripts.
- The entrypoint exports command-registration functions rather than invoking commands at import time.
- Authentication requires an existing logged-in context and derives the service base path from that context.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/tool.jsView file
15919var telemetryInstanceSlot = singleton2("TelemetryService");
L15920: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L15921: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool.jsView on unpkg · L1591947204var registerCommands8 = async (program2) => {
await registerCommands5(program2);
await registerCommands2(program2);
await registerCommands4(program2);
await registerCommands6(program2);
await registerCommands7(program2);
await registerCommands3(program2);
await registerCommands(program2);
};
export {
registerCommands8 as registerCommands,
m
Low
Ai Review Evidence
The entrypoint exports command-registration functions rather than invoking commands at import time.
dist/tool.jsView on unpkg · L4720443965async function resolveAuth(options) {
const status = await getLoginStatusAsync2({
ensureTokenValidityMinutes: options?.loginValidity
});
if (status.loginStatus !== "Logged in" || !status.baseUrl || !status.accessToken) {
throw new Error(status.hint ? `Not logged in. ${status.hint}` : "Not logged in. Run 'uip login' first.");
}
if (!status.organizationId) {
throw new Error("Organization ID not av
Low
Findings
1 High2 Medium6 Low
HighBase64 Obscured Urldist/tool.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool.js
LowAi Review Evidencedist/tool.js
Affected versions and remediation
This report applies to @uipath/admin-tool@1.200.0.
See all versions of @uipath/admin-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/admin-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.