@uipath/auth@1.204.0

Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest points to the inspected runtime bundles, and their network behavior is consistent with authentication and token refresh against the configured HTTPS authority. The scanner’s execution and network indicators resolve to platform and browser helpers and authentication flows; they do not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer invokes an authentication or token-refresh flow.

Impact

No harmful effect was established from the inspected source.

Mechanism

The package sends form-encoded token requests to the authority-derived endpoint; the authority must use HTTPS.

AI rationale

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json routes imports to the Node and browser bundles.
The Node bundle builds authorize and token endpoints from the configured base URL.
The Node bundle requires HTTPS for the authority used in token exchange.
Token exchange posts form data to the configured token endpoint; the browser bundle follows the same pattern.
The browser bundle’s default authority is UiPath Cloud.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.08 MB of source, external domains: cloud.uipath.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 27-67javascript

27 try {

28 const result = fnOrPromise();

29 if (isPromiseLike(result)) {

30 return settlePromiseLike(result);

31 }

32 return [undefined, result];

33 } catch (error) {

34 return [

35 error instanceof Error ? error : new Error(String(error)),

36 undefined

37 ];

38 }

39}

40function settlePromiseLike(thenable) {

41 return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [

42 error instanceof Error ? error : new Error(String(error)),

43 undefined

44 ]);

45}

47// src/constants.ts

48var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", AUTH_RECLAIMED_ERROR_CODE

49var init_constants = __esm(() => {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L47

50 DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;

51});

53// src/utils/platform.ts

54function isBrowser() {

55 return typeof globalThis !== "undefined" && "window" in globalThis && "document" in globalThis;

56}

57function isNode() {

58 return typeof process !== "undefined" && process.versions !== undefined && process.versions.node !== undefined;

59}

60function getGlobalThis() {

61 if (typeof globalThis !== "undefined") {

62 return globalThis;

63 }

64 return;

65}

67// ../../node_modules/is-inside-container/node_modules/is-docker/index.js

Lines 125-165javascript

125 return true;

126 }

127 try {

128 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

129 return

package.jsonView file

Lines 1-36json

2 "name": "@uipath/auth",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.204.0",

Source & flagged code

4 flagged · loading source

dist/index.jsView file

47// src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: const { stdout } = await executePowerShell(command, { powerS

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L47

47Trigger-reachable chain: manifest.main -> dist/index.js L47: // src/constants.ts L48: var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CAN... L49: var init_constants = __esm(() => { ... L141: L142: // ../../node_modules/powershell-utils/index.js L143: import process3 from "node:process"; ... L169: ]; L170: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L171: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L209: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L210: cons

Critical

Findings

2 Critical1 High3 Medium6 Low

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/auth@1.204.0.

See all versions of @uipath/auth for other recorded verdicts.

Review the evidence and your use of @uipath/auth@1.204.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 19:20:44.460Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code