@uipath/auth@1.202.0

Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is the UiPath CLI authentication library: no install hooks, and the flagged spawn, env, and fetch paths implement interactive OIDC login against UiPath identity hosts. Static download-and-execute and shell findings are the bundled open/browser helpers plus token POST, not remote code execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer calls exported login or token helpers such as interactiveLogin or authenticate; npm install does not run this package.

Impact

No confirmed malicious impact. Scanner download-and-execute and shell labels are false positives on the bundled browser opener and fetch of identity token URLs.

Mechanism

User-invoked OIDC browser login and token exchange

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

dist/index.js bundles node:child_process spawn plus PowerShell and xdg-open helpers to launch a URL in the system browser.
The same entrypoint POSTs to an OIDC token URL, reads UIPATH_* environment variables, and writes local UiPath credential files when login APIs run.

Evidence against

package.json has no lifecycle scripts or bin entry; only the dist tree is published.
Process spawning is the bundled open/default-browser stack used when interactive OIDC login opens the user's browser.
Network calls target the configured UiPath identity host (default https://cloud.uipath.com) and a localhost callback, not a third-party drop site.
Credential and env file I/O is invoked from exported login, status, and logout functions, not at install or import time.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 27-67javascript

27 try {

28 const result = fnOrPromise();

29 if (isPromiseLike(result)) {

30 return settlePromiseLike(result);

31 }

32 return [undefined, result];

33 } catch (error) {

34 return [

35 error instanceof Error ? error : new Error(String(error)),

36 undefined

37 ];

38 }

39}

40function settlePromiseLike(thenable) {

41 return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [

42 error instanceof Error ? error : new Error(String(error)),

43 undefined

44 ]);

45}

47// src/constants.ts

48var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", AUTH_RECLAIMED_ERROR_CODE

49var init_constants = __esm(() => {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L47

50 DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;

51});

53// src/utils/platform.ts

54function isBrowser() {

55 return typeof globalThis !== "undefined" && "window" in globalThis && "document" in globalThis;

56}

57function isNode() {

58 return typeof process !== "undefined" && process.versions !== undefined && process.versions.node !== undefined;

59}

60function getGlobalThis() {

61 if (typeof globalThis !== "undefined") {

62 return globalThis;

63 }

64 return;

65}

67// ../../node_modules/is-inside-container/node_modules/is-docker/index.js

Lines 121-165javascript

121 if (os.release().toLowerCase().includes("microsoft")) {

122 if (isInsideContainer()) {

123 return false;

124 }

125 return true;

package.jsonView file

Lines 1-33json

2 "name": "@uipath/auth",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.0",

5 "repository": {

6 "type":

Source & flagged code

5 flagged · loading source

dist/index.jsView file

47// src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: const { stdout } = await executePowerShell(command, { powerS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

47Trigger-reachable chain: manifest.main -> dist/index.js L47: // src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: cons

Critical

Findings

2 Critical2 High3 Medium5 Low

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/auth@1.202.0.

See all versions of @uipath/auth for other recorded verdicts.

Review the evidence and your use of @uipath/auth@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 01:40:54.356Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code