registry / @uipath/ap-chat / 1.7.0
@uipath/ap-chat@1.7.0
⚠ Under reviewApollo Design System - Autopilot Chat web component
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe scanner's download-and-execute match resolves to a language grammar token pattern, and the manifest has no install lifecycle hook. The declared @uipath/apollo-react dependency source was unavailable, so its behavior remains unresolved and requires manual review.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing or importing the package may install or load its declared runtime dependency.
Impact
No package-owned attack was confirmed; the unresolved dependency leaves a review gap.
Mechanism
The package declares @uipath/apollo-react 7.4.0, but its source was unavailable for inspection, so its behavior could not be assessed.
AI rationale
The scanner's download-and-execute match resolves to a language grammar token pattern, and the manifest has no install lifecycle hook. The declared @uipath/apollo-react dependency source was unavailable, so its behavior remains unresolved and requires manual review.
Decision evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares no install lifecycle hook and exposes bundled runtime entry points.
- The flagged bundle match is a language-token pattern listing Nix function names, including fetch-related names; it does not show a download or execution call.
- The main bundle creates an inline worker for audio encoding.
- The manifest declares @uipath/apollo-react 7.4.0, but its source was unavailable for inspection.
Evidence against
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flagged · loading sourcedist/vendors-74.jsView file
1(self.webpackChunk_uipath_ap_chat=self.webpackChunk_uipath_ap_chat||[]).push([["71"],{47312:function(e,t,a){function n(e){e.languages["nand2tetris-hdl"]={comment:/\/\/.*|\/\*[\s\S]...
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/vendors-74.jsView on unpkg · L11baseNameOf|compareVersions|concatLists|currentSystem|deepSeq|derivation|dirOf|div|elem(?:At)?|fetch(?:Tarball|url)|filter(?:Source)?|fromJSON|genList|getAttr|getEnv|hasAttr|hashString|head|import|intersectAttrs|is(?:Attrs|Bool|Function|Int|List|Null|String)|length|lessThan|listToAttrs|map|mul|parseDrvName|pathExists|re
Low
Ai Review Evidence
The flagged bundle match is a language-token pattern listing Nix function names, including fetch-related names; it does not show a download or execution call.
dist/vendors-74.jsView on unpkg · L1package.jsonView file
64"scripts": {
"build": "NODE_ENV=production rsbuild build && tsc --project tsconfig.build.json",
"build:analyze": "NODE_ENV=production BUNDLE_ANALYZE=true rsbuild build",
"dev": "NODE_ENV=development rsbuild dev",
"lint": "biome lint
Findings
1 Critical1 Medium9 Low
CriticalDownload Executedist/vendors-74.js
MediumNetwork
LowScripts Present
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/vendors-74.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @uipath/ap-chat@1.7.0.
See all versions of @uipath/ap-chat for other recorded verdicts.
- Review the evidence and your use of @uipath/ap-chat@1.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.