@uipath/auth@1.202.1

Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The inspected entrypoint implements authority-bound OAuth token exchange and refresh behavior. No lifecycle hook or concrete malicious behavior was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A caller invokes the exported authentication flow or token refresh functions.

Impact

No unconsented execution, persistence, destructive action, or credential export to an unrelated recipient was identified.

Mechanism

The runtime validates the authority as HTTPS and posts OAuth form data to its derived token endpoint.

AI rationale

The inspected entrypoint implements authority-bound OAuth token exchange and refresh behavior. No lifecycle hook or concrete malicious behavior was found.

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package metadata exposes dist/index.js as the default runtime entry.
The runtime validates an HTTPS authority, derives OIDC endpoints from it, and posts token exchanges only to the derived token endpoint.
Refresh responses are checked against the expected authority before use.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.07 MB of source, external domains: cloud.uipath.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 27-67javascript

27 try {

28 const result = fnOrPromise();

29 if (isPromiseLike(result)) {

30 return settlePromiseLike(result);

31 }

32 return [undefined, result];

33 } catch (error) {

34 return [

35 error instanceof Error ? error : new Error(String(error)),

36 undefined

37 ];

38 }

39}

40function settlePromiseLike(thenable) {

41 return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [

42 error instanceof Error ? error : new Error(String(error)),

43 undefined

44 ]);

45}

47// src/constants.ts

48var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", AUTH_RECLAIMED_ERROR_CODE

49var init_constants = __esm(() => {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L47

50 DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;

51});

53// src/utils/platform.ts

54function isBrowser() {

55 return typeof globalThis !== "undefined" && "window" in globalThis && "document" in globalThis;

56}

57function isNode() {

58 return typeof process !== "undefined" && process.versions !== undefined && process.versions.node !== undefined;

59}

60function getGlobalThis() {

61 if (typeof globalThis !== "undefined") {

62 return globalThis;

63 }

64 return;

65}

67// ../../node_modules/is-inside-container/node_modules/is-docker/index.js

Lines 125-165javascript

125 return true;

126 }

127 try {

128 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

129 return

package.jsonView file

Lines 1-33json

2 "name": "@uipath/auth",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.1",

5 "repository": {

6 "type":

Source & flagged code

4 flagged · loading source

dist/index.jsView file

47// src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: const { stdout } = await executePowerShell(command, { powerS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

47Trigger-reachable chain: manifest.main -> dist/index.js L47: // src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: cons

Critical

Findings

2 Critical1 High3 Medium6 Low

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/auth@1.202.1.

See all versions of @uipath/auth for other recorded verdicts.

Review the evidence and your use of @uipath/auth@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 11:37:55.503Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code