registry / AI-agent capability abuse / @uipath/cli / 1.201.0

@uipath/cli@1.201.0

Cross platform CLI for UiPath

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The scanner's credential-exfiltration conclusion is not supported by an automatic path in the inspected manifest or command code. The package still warrants a warning because it intentionally modifies AI-agent skill locations and can upload selected files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs uip skills install or uip feedback send with attachments.

Impact

User-selected project or agent configuration files can be changed, and selected feedback files can leave the machine.

Mechanism

Explicit agent-skill installation and feedback attachment upload.

AI rationale

Evidence

dist/index.js.agents/skills.claude/skills.cursor/skills

Network endpoints1

studio-feedback.azure-api.net

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit skills command installs content for coding agents and supports local project targets.
The feedback command uploads user-selected files to a fixed feedback service.

Evidence against

package.json has no install lifecycle script.
Agent configuration changes require an explicit CLI command.
Feedback attachments are supplied by the user and capped at ten files of ten megabytes each.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 696 KB of source, external domains: github.com, jmespath.org, npm.pkg.github.com, uipath.atlassian.net

Oversized source lightweight scan

Source & flagged code

15 flagged

dist/services.feedback.browser.jsView file

Lines 1-38javascript

1// Process global — must exist before bundle init

2if (!globalThis.process) { globalThis.process = {

3 env: { NO_COLOR: "1", FORCE_COLOR: "0", NODE_ENV: "production" },

4 cwd: function() { return "/"; },

5 platform: "browser",

6 argv: ["browser", "uip"],

7 stdout: { isTTY: false, write: function(d) { console.log(d); return true; }, columns: 80 },

8 stderr: { isTTY: false, write: function(d) { console.error(d); return true; }, columns: 80 },

9 stdin: { isTTY: true, setEncoding: function() {}, on: function() { return this; }, resume: function() { return this; }, pause: function() { return this; } },

10 exit: function() {},

11 version: "v20.0.0",

12 versions: { node: "20.0.0" }

13}; }

14var process = globalThis.process;

15var process2 = globalThis.process;

16var Sa=Object.create;var kt=Object.defineProperty;var Ca=Object.getOwnPropertyDescriptor;var ka=Object.getOwnPropertyNames;var Aa=Object.getPrototypeOf,Pa=Object.prototype.hasOwnProperty;var he=(n,e,t

17`:(t+=`

19`),s=this._makeRoot(),a=[{indent:-1,node:s},{indent:0,node:null}];for(let u of i){let c=u.match(/^\t*/)[0].length;u=u.slice(c);let[p,...f]=u.split(" "),w=r(f);if(c<=a[a.length-1].indent)for(;c<=a[a.length-1].indent;)a.pop();a.push({indent:c,node:w}),a[a.length-2].node.set(p,w)}return s}_lookup(e,t=!0){let r=this._root,i="/",s=ne.split(e);for(let a=0;a<s.length;++a){let u=s[a];if(r=r.get(u),!r)throw new qa(e);if(t||a<s.length-1){let d=r.get(Z);if(d.type==="symlink"){let c=ne.resolve(i,d.target);r=this._lookup(c)}i?i=ne.join(i,u):i=u}}return r}mkdir(e,{mode:t}){if(e==="/")throw new ti;let r=this ...

20`)}displayWidth(e){return Gi(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(t=>t==="[options]"?this.styleOptionText(t):t==="[command]"?this.styleSubcommandText(t):t[0]==="["||t[0]==="<"

21`+" ".repeat(t+d)),a+u+" ".repeat(d)+f.replace(/\n/g,`

22${a}`)}boxWrap(e,t){if(t<this.minWidthToWrap)return e;let r=e.split(/\r\n|\n/),i=/[\s]*[^\s]+/g,s=[];return r.forEach(a=>{let u=a.match(i);if(u===null){s.push("");return}let d=[u.shift()],c=this.displayWidth(d[0]);u.forEach(p=>{let f=this.displayWidth(p);if(c+f<=t){d.push(p),c+=f;return}s.push(d.join(""));let w=p.trimStart();d=[w],c=this.displayWidth(w)}),s.push(d.join(""))}),s.join(`

23`)}};function Gi(n){let e=/\x1b\[\d*(;\d*)*m/g;return n.replace(e,"")}Pn.Help=An;Pn.stripColor=Gi});var Ln=z(Nn=>{"use strict";var{InvalidArgumentError:Fl}=rt(),Rn=class{constructor(e,t){this.flags=e,this.description=t||"",this.required=e.includes("<"),this.optional=e.includes("["),this.variadic=/\w\.\.\.[>\]]$/.test(e),this.mandatory=!1;let r=Ml(e);this.short=r.shortFlag,this.long=r.longFlag,this.negate=!1,this.long&&(this.negate=this.long.startsWith("--no-")),this.defaultValue=void 0,this.defaultValueDescription=void 0,this.presetArg=void 0,this.envVar=void 0,this.parseArg=void 0,this.hidden ...

24- a short flag is a single dash and a single character

25 - either use a single dash and a single character (for a short flag)

26 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`):r.test(a)?new Error(`${u}

27- too many short flags`):i.test(a)?new Error(`${u}

28- too many long flags`):new Error(`${u}

29- unrecognised flag format`)}if(e===void 0&&t===void 0)throw new Error(`option creation failed due to no flags found in '${n}'.`);return{shortFlag:e,longFlag:t}}Nn.Option=Rn;Nn.DualOptions=In});var Wi=z(Vi=>{

30(Did you mean one of ${r.join(", ")}?)`:r.length===1?`

31(Did you mean ${r[0]}?)`:""}Vi.suggestSimilar=$l});var Ji=z(Hn=>{"use strict";var Hl=(Ii(),Ve(Ri)).EventEmitter,Fn=(Nt(),Ve(Li)),Se=(Mi(),Ve(Fi)),Ft=(Ui(),Ve(Hi)),j=(qi(),Ve(ji)),{Argument:Ul,humanReadableArgName:jl}=It(),{CommanderError:Mn}=rt(),{Help:ql,stripColor:Gl}=On(),{Option:Yi,DualOptions:Bl}=Ln(),{suggestSimilar:zi}=Wi(),Dn=class n extends Hl{constructor(e){super(),this.commands=[],this.options=[],this.parent=null,this._allowUnknownOption=!1,this._allowExcessArguments=!1,this.registeredArguments=[],this._args=this.registeredArguments,this.args=[],this.rawArgs=[],this.processedArgs=[] ...

32- specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerCommand(e),e.parent=this,e._checkForBrokenPassThrough(),this}createArgument(e,t){return new Ul(e,t)}argument(e,t,r,i){let s=this.createArgument(e,t);return typeof r=="function"?s.default(i).argParser(r):s.default(r),this.addArgument(s),this}arguments(e){return e.trim().split(/ +/).forEach(t=>{this.argument(t)}),this}addArgument(e){let t=this.registeredArguments.slice(-1)[0];if(t?.variadic)throw new

33Expecting one of '${r.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e:this._exitCallback=t=>{if(t.code!==

34- already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=i=>[i.name()].concat(i.aliases()),r=t(e).find(i=>this._findCommand(i));if(r){let i=t(this._findCommand(r)).join("|"),s=t(e).join("|");throw new Error(`cannot add command '${s}' as already have command '${i}'`)}this._initCommandGroup(e),this.commands.push(e)}addOption(e){this._registerOption(e);let t=e.name(),r=e.attributeName();if(e.negate){let s=e.long.replace(/^--no-/,"--");this._findOption(s)||this.setOptionValueWithSource(r,e.defaultValue===void 0?!0:e.defaultValue,"default")}el ...

35- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],

36 - if '${r}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

37 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

38 - ${i}`;throw new Error(s)}_executeSubCommand(e,t){t=t.slice();let r=!1,i=[".js",".ts",".tsx",".mjs",".cjs"];function s(p,f

Long lines were clipped for display.

6Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/services.feedback.browser.js L6: argv: ["browser", "uip"], L7: stdout: { isTTY: false, write: function(d) { console.log(d); return true; }, columns: 80 }, L8: stderr: { isTTY: false, write: function(d) { console.error(d); return true; }, columns: 80 }, ... L15: var process2 = globalThis.process; L16: var Sa=Object.create;var kt=Object.defineProperty;var Ca=Object.getOwnPropertyDescriptor;var ka=Object.getOwnPropertyNames;var Aa=Object.getPrototypeOf,Pa=Object.prototype.hasOwnPr... L17: `:(t+=` L18: `,r(u,s+1))}};return r(e,0),t}parse(e){let t=0;function r(u){let d=++t,c=u.length===1?"dir":"file",[p,f,w]=u;return p=parseInt(p,8),f=f?parseInt(f):0,w=w?parseInt(w):Date.now(),new... L19: `),s=this._makeRoot(),a=[{ind

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/services.feedback.browser.jsView on unpkg · L6

76`:`${e} ${t.map(String).join(" ")} L77: `}isFileLoggingActive(){return this.fileLoggingEnabled||!!qn()}writeToFile(e){let t=this.logFilePath||qn();if(!t)return;let r=new Date().toISOString();this.pendingWrites=Promise.al... L78: `),Dr(t))}function Je(n){return n!=null&&typeof n=="object"?JSON.stringify(n):String(n??"")}function rd(n,e){if(n.length<=e)return[n];let t=[];for(let r=0;r<n.length;r+=e)t.push(n....

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/services.feedback.browser.jsView on unpkg · L76

dist/index.jsView file

124L125: // ../../node_modules/powershell-utils/index.js L126: import process3 from "node:process"; ... L152: ]; L153: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L154: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L192: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L193: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L194: return stdout.trim(); ... L424: } L425: var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEachApp = async (apps, opener) => { L426: if (apps.length === 0) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L124

124Trigger-reachable chain: manifest.main -> dist/index.js L124: L125: // ../../node_modules/powershell-utils/index.js L126: import process3 from "node:process"; ... L152: ]; L153: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L154: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L192: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L193: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L194: return stdout.trim(); ... L424: } L425: var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEachApp = async (apps, opener) => { L426: if (apps.length =

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L124

dist/index.browser.jsView file

•path = dist/index.browser.js kind = oversized_source_file sizeBytes = 22022513 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.browser.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/services.feedback.browser.jsView file

18`,r(u,s+1))}};return r(e,0),t}parse(e){let t=0;function r(u){let d=++t,c=u.length===1?"dir":"file",[p,f,w]=u;return p=parseInt(p,8),f=f?parseInt(f):0,w=w?parseInt(w):Date.now(),new... L19: `),s=this._makeRoot(),a=[{indent:-1,node:s},{indent:0,node:null}];for(let u of i){let c=u.match(/^\t*/)[0].length;u=u.slice(c);let[p,...f]=u.split(" "),w=r(f);if(c<=a[a.length-1].i... L20: `)}displayWidth(e){return Gi(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(t=>t==="[options]"?this.styleOptionText(t):t==="[command]"?this.styleSubcommandT...

High

Child Process

Package source references child process execution.

dist/services.feedback.browser.jsView on unpkg · L18

6argv: ["browser", "uip"], L7: stdout: { isTTY: false, write: function(d) { console.log(d); return true; }, columns: 80 }, L8: stderr: { isTTY: false, write: function(d) { console.error(d); return true; }, columns: 80 }, ... L15: var process2 = globalThis.process; L16: var Sa=Object.create;var kt=Object.defineProperty;var Ca=Object.getOwnPropertyDescriptor;var ka=Object.getOwnPropertyNames;var Aa=Object.getPrototypeOf,Pa=Object.prototype.hasOwnPr... L17: `:(t+=` L18: `,r(u,s+1))}};return r(e,0),t}parse(e){let t=0;function r(u){let d=++t,c=u.length===1?"dir":"file",[p,f,w]=u;return p=parseInt(p,8),f=f?parseInt(f):0,w=w?parseInt(w):Date.now(),new... L19: `),s=this._makeRoot(),a=[{indent:-1,node:s},{indent:0,node:null}];for(let u of i){let c=u.match(/^\t*/)[0].length;u=u.slice(c);let[p,...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

Findings

2 Critical11 High5 Medium3 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/services.feedback.browser.js

HighShelldist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/services.feedback.browser.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCloud Metadata Accessdist/index.js

HighCross File Remote Execution Contextdist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/services.feedback.browser.js

Affected versions and remediation

This report applies to @uipath/cli@1.201.0.

See all versions of @uipath/cli for other recorded verdicts.

Review the evidence and your use of @uipath/cli@1.201.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 13:37:22.114Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code