registry / @uipath/case-tool / 1.202.1

@uipath/case-tool@1.202.1

Manage Case Management instances, processes, and incidents.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found no lifecycle scripts or concrete malicious behavior. The observed process-spawn and telemetry code are consistent with CLI operation and redact sensitive values.

Static reason

One or more suspicious static signals were detected.

Trigger

User invocation of the command-line interface or a caller using the opener helper.

Impact

No unconsented installation action, credential exfiltration, persistence, or destructive behavior was identified.

Mechanism

The inspected launcher spawns a selected platform command with separate arguments; telemetry redacts sensitive fields.

AI rationale

Static inspection found no lifecycle scripts or concrete malicious behavior. The observed process-spawn and telemetry code are consistent with CLI operation and redact sensitive values.

Evidence

package.jsondist/index.jsdist/index-h8cph72k.jsdist/packager-tool-8m22sr4j.js

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package metadata declares module and library entrypoints, with no lifecycle hook present.
The CLI entrypoint creates a command program and registers commands before parsing user arguments.
The required launcher helper passes a command and argument array to process spawning rather than constructing a shell command.
Telemetry handling redacts values whose property names are sensitive.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 95 file(s), 15.0 MB of source, external domains: alpha.uipath.com, api.example.com, bpmn.io, bpmn.uipath.com, cloud.uipath.com, docs.uipath.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, json-schema.org, npm.pkg.github.com, purl.org, raw.githubusercontent.com, schemas.microsoft.com, schemas.openxmlformats.org, serverlessworkflow.io, staging.uipath.com, uipath.com, uipath.org, www.omg.org, www.w3.org

Source & flagged code

6 flagged

dist/index.umd.min-fqefd9kn.jsView file

Lines 1814-1854javascript

1814 constructor(e2) {

1815 var t2;

1816 let n2;

1817 this.refs = {}, this.dynamicAnchors = {}, typeof e2.schema == "object" && (n2 = e2.schema), this.schema = e2.schema, this.schemaId = e2.schemaId, this.root = e2.root || this, this.baseId = (t2 = e2.baseId) !== null && t2 !== undefined ? t2 : (0, Ze.normalizeId)(n2 == null ? undefined : n2[e2.schemaId || "$id"]), this.schemaPath = e2.schemaPath, this.localRefs = e2.localRefs, this.meta = e2.meta, this.$async = n2 == null ? undefined : n2.$async, this.refs = {};

1818 }

1819 }

1820 function et(e2) {

1821 const t2 = nt.call(this, e2);

1822 if (t2)

1823 return t2;

1824 const n2 = (0, Ze.getFullPath)(this.opts.uriResolver, e2.root.baseId), { es5: r2, lines: o2 } = this.opts.code, { ownProperties: i2 } = this.opts, a2 =

1825 let s2;

1826 e2.$async && (s2 = a2.scopeValue("Error", { ref: Ke.default, code: He._`require("ajv/dist/runtime/validation_error").default` }));

1827 const l2 = a2.scopeName("validate");

1828 e2.validateName = l2;

1829 const c2 = { gen: a2, allErrors: this.opts.allErrors, data: Je.default.data, parentData: Je.default.parentData, parentDataProperty: Je.default.parentDataProperty, dataNames: [Je.default.data], dataPathArr: [He.nil], dataLevel: 0, dataTypes: [], definedProperties: new Set, topSchemaRef: a2.scopeValue("schema", this.opts.code.source === true ? { ref: e2.schema, code: (0, He.stringify)(e2.schema) } : { ref: e2.schema }), validateName: l2, ValidationError: s2, schema: e2.schema, schemaEnv: e2, rootId: n2, baseId: e2.baseId ||

1830 let u2;

1831 try {

1832 this._compilations.add(e2), (0, Qe.validateFunctionCode)(c2), a2.optimize(this.opts.code.optimize);

1833 const t3 = a2.toString();

1834 u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2));

1835 const n3 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get());

1836 if (this.scope.value(l2, { ref: n3 }), n3.errors = null, n3.schema = e2.schema, n3.schemaEnv = e2, e2.$async && (n3.$async = true), this.opts.code.source === true && (n3.source = { validateName: l2, validateCode: t3, scopeValues: a2._values }), this.opts.unevaluated) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.umd.min-fqefd9kn.js

1837 const { props: e3, items: t4 } = c2;

1838 n3.evaluated = { props: e3 instanceof He.Name ? undefined : e3, items: t4 instanceof He.Name ? undefined : t4, dynamicProps: e3 instanceof He.Name, dynamicItems: t4 instanceof

1839 }

1840 return e2.validate = n3, e2;

1841 } catch (t3) {

1842 throw delete e2.validate, delete e2.validateName, u2 && this.logger.error("Error compiling schema, function code:", u2), t3;

1843 } finally {

1844 this._compilations.delete(e2);

1845 }

1846 }

1847 function tt(e2) {

1848 return (0, Ze.inlineRef)(e2.schema, this.opts.inlineRefs) ? e2.schema : e2.validate ? e2 : et.call(this, e2);

1849 }

1850 function nt(e2) {

1851 for (const r2 of this._compilations)

1852 if (n2 = e2, (t2 = r2).schema === n2.schema && t2.root === n2.root && t2.baseId === n2.baseId)

1853 return r2;

1854 var t2, n2;

Long lines were clipped for display.

dist/packager-tool-8m22sr4j.jsView file

Lines 3691-3731javascript

3691 }

3692 getState().commandStart = performance.now();

3693}

3694function recordCommandDuration(durationMs) {

3695 if (!timingsEnabled()) {

dist/index-h8cph72k.jsView file

Lines 481-521javascript

481 const isBundled = !__dirname2 || __dirname2 === "/";

482 let exeLocalXdgOpen = false;

483 try {

package.jsonView file

Lines 1-32json

2 "name": "@uipath/case-tool",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.1",

5 "description": "Manage Case Management instances, processes, and incidents.",

dist/index.jsView file

Lines 3-30javascript

3 metadata,

4 registerCommands

5} from "./packager-tool-e65xt669.js";

6import"./packager-tool-sv0d6wb6.js";

7import"./packager-tool-0mj06yen.js";

8import"./packager-tool-6q9vpaye.js";

9import"./packager-tool-r84ng21s.js";

Source & flagged code

6 flagged · loading source

dist/index.umd.min-fqefd9kn.jsView file

1834u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2)); L1835: const n3 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get()); L1836: if (this.scope.value(l2, { ref: n3 }), n3.errors = null, n3.schema = e2.schema, n3.schemaEnv = e2, e2.$async && (n3.$async = true), this.opts.code.source === true && (n3.source = {...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.umd.min-fqefd9kn.jsView on unpkg · L1834

dist/packager-tool-8m22sr4j.jsView file

3711var telemetryInstanceSlot = singleton("TelemetryService"); L3712: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L3713: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/packager-tool-8m22sr4j.jsView on unpkg · L3711

dist/index-h8cph72k.js

Findings

2 High2 Medium8 Low

HighBase64 Obscured Urldist/packager-tool-8m22sr4j.js

HighSemantic Analysis Limiteddist/index-h8cph72k.js

MediumNetwork

MediumEnvironment Vars

LowEvaldist/index.umd.min-fqefd9kn.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/index-h8cph72k.js

Affected versions and remediation

This report applies to @uipath/case-tool@1.202.1.

See all versions of @uipath/case-tool for other recorded verdicts.

Review the evidence and your use of @uipath/case-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:50:00.904Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code