registry / @uipath/agent-tool / 1.200.0
@uipath/agent-tool@1.200.0
cli plugin for creating and managing UiPath low-code agents
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection found a normal user-invoked CLI without lifecycle hooks or runtime self-dependencies. The inspected required bundles support command registration, confirmation, and local filesystem access rather than a concrete attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The executable path is activated when the user invokes the agent-tool CLI.
Impact
No unconsented installation-time execution, persistence, exfiltration, or destructive behavior was established.
Mechanism
The CLI loads its command registry and local filesystem helper; irreversible operations use an explicit confirmation gate.
AI rationale
Static inspection found a normal user-invoked CLI without lifecycle hooks or runtime self-dependencies. The inspected required bundles support command registration, confirmation, and local filesystem access rather than a concrete attack.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata exposes a CLI and library entry points, with no lifecycle scripts or runtime dependencies.
- The primary bundle identifies itself as a UiPath agent-management command tool and registers named CLI commands.
- The CLI helper requires an explicit confirmation flag for irreversible operations.
- The required filesystem bundle exports a local Node filesystem abstraction; no active attack behavior was identified in the inspected entry path.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcedist/packager-tool-q9z6zmqk.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @uipath/agent-tool@1.201.0
matchedIdentity = npm:QHVpcGF0aC9hZ2VudC10b29s:1.201.0
similarity = 0.378
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/packager-tool-q9z6zmqk.jsView on unpkg20066import { promisify } from "node:util";
L20067: import childProcess from "node:child_process";
L20068: import { promisify as promisify2 } from "node:util";
High
Child Process
Package source references child process execution.
dist/packager-tool-q9z6zmqk.jsView on unpkg · L20066•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/packager-tool-q9z6zmqk.js:
Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
Utils.prototype.writeFileToAsync = function(path, content, overwrite, attr, callback) {
filetools.writeFileTo(childName, content2, overwrite, fileAttr2);
filetools.writeFileTo(target, content, overwrite, fileAttr);
filetools.writeFileTo(entryName, content, overwrite, fileAttr);
filetools.writeFileToAsync(filePath, content, overwrite, fileAttr, function(succ) {
var ok = filetools.writeFileTo(targetFileName, zipData, true);
filetools.writeFileToAsync(targetFileName, zipData, overwrite, perm, ret);
Findings
1 Critical6 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/packager-tool-q9z6zmqk.js
HighChild Processdist/packager-tool-q9z6zmqk.js
HighCredential Redirect Persistencedist/packager-tool-q9z6zmqk.js
HighCommand Output Exfiltrationdist/packager-tool-q9z6zmqk.js
HighCross File Remote Execution Contextdist/packager-tool-q9z6zmqk.js
HighBase64 Obscured Urldist/packager-tool-wfbw3w4y.js
HighSemantic Analysis Limiteddist/packager-tool-mf36zc9b.js
MediumDynamic Requiredist/packager-tool-wfbw3w4y.js
MediumNetwork
MediumEnvironment Vars
LowEvaldist/index.umd.min-drpc57vn.js
LowFilesystem
Affected versions and remediation
This report applies to @uipath/agent-tool@1.200.0.
See all versions of @uipath/agent-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/agent-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.