@uipath/cli@1.200.1

Cross platform CLI for UiPath

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has no install lifecycle hook and its entrypoint is an invoked CLI. The suspicious primitives are feature-aligned, with no confirmed credential exfiltration or covert persistence.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running an explicit CLI command such as feedback send.

Impact

The selected feedback text and attachments can be sent when the user invokes the feedback command.

Mechanism

User-directed feedback upload and standard CLI telemetry.

AI rationale

The package has no install lifecycle hook and its entrypoint is an invoked CLI. The suspicious primitives are feature-aligned, with no confirmed credential exfiltration or covert persistence.

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no lifecycle scripts and exposes the CLI only through its main and bin entrypoint.
The entrypoint runs only when invoked as the main program; it exports its API otherwise.
Feedback file reads and uploads are reachable only through the explicit feedback command and user-supplied attachment paths.
The browser feedback artifact is a browser bundle with a minimal process shim, not an install hook or credential collector.

Evidence against

The CLI includes telemetry and an explicit feedback upload feature, including an Azure-hosted endpoint.
The CLI can read stored UiPath credentials for its authenticated commands, but the inspected feedback request does not send them.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

Source & flagged code

14 flagged

dist/index.jsView file

49L50: // ../../node_modules/undici/lib/core/symbols.js L51: var require_symbols = __commonJS((exports, module) => { ... L73: kBodyUsed: Symbol("used"), L74: kBody: Symbol("abstracted request body"), L75: kRunning: Symbol("running"), ... L818: } L819: const code = this.code = key.charCodeAt(index); L820: if (code > 127) { ... L1615: } L1616: var setupConnectTimeout = process.platform === "win32" ? (socketWeakRef, opts) => { L1617: if (!opts.timeout) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L49

49Trigger-reachable chain: manifest.main -> dist/index.js L49: L50: // ../../node_modules/undici/lib/core/symbols.js L51: var require_symbols = __commonJS((exports, module) => { ... L73: kBodyUsed: Symbol("used"), L74: kBody: Symbol("abstracted request body"), L75: kRunning: Symbol("running"), ... L818: } L819: const code = this.code = key.charCodeAt(index); L820: if (code > 127) { ... L1615: } L1616: var setupConnectTimeout = process.platform === "win32" ? (socketWeakRef, opts) => { L1617: if (!opts.timeout) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L49

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/cli@1.201.0 matchedIdentity = npm:QHVpcGF0aC9jbGk:1.201.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: "Authorization", "Proxy-Authorization", get baseUrl() { return this.baseUrl?.origin; var proxyAuthorization = "proxy-authorization"; this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`; this[kProxyHeaders]["proxy-authorization"] = opts.token; this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L49

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L49

49Cross-file remote execution chain: dist/index.js spawns dist/services.feedback.browser.js; helper contains network access plus dynamic code execution. L49: L50: // ../../node_modules/undici/lib/core/symbols.js L51: var require_symbols = __commonJS((exports, module) => { ... L73: kBodyUsed: Symbol("used"), L74: kBody: Symbol("abstracted request body"), L75: kRunning: Symbol("running"), ... L818: } L819: const code = this.code = key.charCodeAt(index); L820: if (code > 127) { ... L1615: } L1616: var setupConnectTimeout = process.platform === "win32" ? (socketWeakRef, opts) => { L1617: if (!opts.timeout) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L49

49Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L49: L50: // ../../node_modules/undici/lib/core/symbols.js L51: var require_symbols = __commonJS((exports, module) => { ... L73: kBodyUsed: Symbol("used"), L74: kBody: Symbol("abstracted request body"), L75: kRunning: Symbol("running"), ... L818: } L819: const code = this.code = key.charCodeAt(index); L820: if (code > 127) { ... L1615: } L1616: var setupConnectTimeout = process.platform === "win32" ? (socketWeakRef, opts) => { L1617: if (!opts.timeout) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L49

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 5442439 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

dist/services.feedback.browser.jsView file

Lines 1-26javascript

1// Process global — must exist before bundle init

2if (!globalThis.process) { globalThis.process = {

3 env: { NO_COLOR: "1", FORCE_COLOR: "0", NODE_ENV: "production" },

4 cwd: function() { return "/"; },

dist/index.browser.jsView file

•path = dist/index.browser.js kind = oversized_source_file sizeBytes = 19745765 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.browser.jsView on unpkg

Source & flagged code

14 flagged · loading source

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L49

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L49

Findings

3 Critical9 High5 Medium3 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/services.feedback.browser.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCloud Metadata Accessdist/index.js

HighCross File Remote Execution Contextdist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/services.feedback.browser.js

HighBase64 Obscured Urldist/services.feedback.browser.js

Affected versions and remediation

This report applies to @uipath/cli@1.200.1.

See all versions of @uipath/cli for other recorded verdicts.

Review the evidence and your use of @uipath/cli@1.200.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 23:44:43.847Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code