@uipath/admin-tool@1.202.0
Manage UiPath admin resources — Identity Server, Resource Catalog Service, Audit Service, VPN Gateway.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a first-party UiPath admin CLI library with no lifecycle hooks and an export-only entrypoint. Bundled process, auth, and telemetry helpers stay inside normal command use and do not form an install-time attack.
Decision evidence
public snapshot- package.json version 1.202.0 points main and exports at dist/tool.js and declares no install lifecycle scripts, bin, or dependencies.
- dist/tool.js is a bundled ESM command library whose module result is metadata and registerCommands, so import does not run an installer or network payload.
- The bundle contains child_process, Windows registry reads, local ~/.uipath auth paths, and a decoded Application Insights connection string, all consistent with a user-invoked UiPath CLI rather than an install-time attack.
Source & flagged code
3 flagged · loading sourceSource decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool.jsView on unpkg · L22902dist/tool.js is a bundled ESM command library whose module result is metadata and registerCommands, so import does not run an installer or network payload.
dist/tool.jsView on unpkg · L50355Findings
Affected versions and remediation
This report applies to @uipath/admin-tool@1.202.0.
See all versions of @uipath/admin-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/admin-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.