@uipath/auth@1.203.0

Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Static source inspection found authentication traffic to the configured HTTPS authority and process launching in a browser-opening helper. The scanner's high-risk labels are not supported by the inspected excerpts as remote-code download or malicious execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Authentication flows and browser-opening functionality invoked by the package consumer.

Impact

These inspected behaviors match the package's authentication purpose; no malicious payload execution or credential exfiltration was established.

Mechanism

The module exchanges an authorization code at the configured token endpoint and calls the UiPath organization API with a bearer token; a browser helper launches a platform browser command.

AI rationale

Evidence

package.jsondist/index.js

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package entrypoint is the published JavaScript module under dist.
The source validates authentication authority URLs as HTTPS.
The source sends authorization-code credentials to the configured token endpoint as an OAuth exchange.
The source uses a bearer token for UiPath organization API requests.
The child-process use occurs in a browser-opening helper.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.08 MB of source, external domains: cloud.uipath.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 27-67javascript

27 try {

28 const result = fnOrPromise();

29 if (isPromiseLike(result)) {

30 return settlePromiseLike(result);

31 }

32 return [undefined, result];

33 } catch (error) {

34 return [

35 error instanceof Error ? error : new Error(String(error)),

36 undefined

37 ];

38 }

39}

40function settlePromiseLike(thenable) {

41 return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [

42 error instanceof Error ? error : new Error(String(error)),

43 undefined

44 ]);

45}

47// src/constants.ts

48var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", AUTH_RECLAIMED_ERROR_CODE

49var init_constants = __esm(() => {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L47

50 DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;

51});

53// src/utils/platform.ts

54function isBrowser() {

55 return typeof globalThis !== "undefined" && "window" in globalThis && "document" in globalThis;

56}

57function isNode() {

58 return typeof process !== "undefined" && process.versions !== undefined && process.versions.node !== undefined;

59}

60function getGlobalThis() {

61 if (typeof globalThis !== "undefined") {

62 return globalThis;

63 }

64 return;

65}

67// ../../node_modules/is-inside-container/node_modules/is-docker/index.js

Lines 125-165javascript

125 return true;

126 }

127 try {

128 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

129 return

package.jsonView file

Lines 1-34json

2 "name": "@uipath/auth",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

4 flagged · loading source

dist/index.jsView file

47// src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: const { stdout } = await executePowerShell(command, { powerS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

47Trigger-reachable chain: manifest.main -> dist/index.js L47: // src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: cons

Critical

Findings

2 Critical1 High3 Medium6 Low

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/auth@1.203.0.

See all versions of @uipath/auth for other recorded verdicts.

Review the evidence and your use of @uipath/auth@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:27:56.759Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code