@uipath/cli@1.202.1

Cross platform CLI for UiPath

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Source establishes package-owned agent plugin installation with later automatic updates, warranting a lifecycle capability warning under the supplied policy. No npm install hook mutation or concrete malicious behavior was established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An explicit skills installation, followed by eligible CLI invocations that run daily updates.

Impact

Agent skills and plugin content can change on later CLI use without a fresh agent selection prompt.

Mechanism

The CLI invokes Claude marketplace and plugin commands, records selected agents, and reuses those selections during updates.

AI rationale

Evidence

dist/index-vmj27s6h.jsdist/index-9d17sa6t.js.claudeknown_marketplaces.json

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit skills install command resolves agent targets before installing.
Without an agent option, skills installation targets all detected supported agents.
Claude integration registers a local marketplace and installs the UiPath plugin.
Claude configuration uses CLAUDE_CONFIG_DIR or the user's .claude directory.
Later updates reuse agents recorded in the skills manifest.
The daily CLI update path enables skills updates, which can update the Claude marketplace and plugin.

Evidence against

package.json contains no npm installation lifecycle hooks or runtime self-dependency.
The inspected integration is package-owned and activated through CLI use; no concrete malicious attack was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

Source & flagged code

14 flagged

dist/applicationinsights-s28k1t0d.jsView file

11246exports.execAsync = undefined; L11247: var child_process = __require("child_process"); L11248: var util = __require("util");

High

Child Process

Package source references child process execution.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L11246

410this._logToConsole = true; L411: var logDestination = process.env.APPLICATIONINSIGHTS_LOG_DESTINATION; L412: if (logDestination == "file+console") { ... L428: } else { L429: this._tempDir = path.join(process.cwd(), logFilePath); L430: } ... L748: try { L749: var jsonConfig = JSON.parse(jsonString); L750: if (jsonConfig.disableStatsbeat != null) { ... L2650: try { L2651: moduleVersion = originalRequire.call(this, path.join(moduleId, "package.json")).version; L2652: } catch (e) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L410

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L410

dist/index-vmj27s6h.jsView file

Lines 14-54javascript

14import {

15 exports_external

16} from "./index-hrt7fpkk.js";

17import {

18 yaml

19} from "./index-d3w0wn6k.js";

20import {

dist/mcp-z5911fjd.jsView file

Lines 2889-2929javascript

2889 validateName,

2890 ValidationError: _ValidationError,

2891 schema: sch.schema,

2892 schemaEnv: sch,

2893 rootId,

2894 baseId: sch.baseId || rootId,

2895 schemaPath

dist/index-469jgr1w.jsView file

Lines 59-99javascript

59 return new Md4(true).update(message)[outputType]();

60 };

61 };

62 var createMethod = function() {

dist/index-9d17sa6t.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/cli@1.202.0 matchedIdentity = npm:QHVpcGF0aC9jbGk:1.202.0 similarity = 0.970 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-9d17sa6t.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-9d17sa6t.js: await this.fs.writeFile(path, content); await fs.writeFile(target.scriptPath, target.scriptContent); await fs.writeFile(target.rcPath, target.content); await fs.writeFile(target.rcPath, `${target.content} await fs.writeFile(target.rcPath, next); await fs.writeFile(target.rcPath, next); await fs.writeFile(tempPath, JSON.stringify(config, null, 4)); async fetchTenants(baseUrl, accessToken, organizationId) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-9d17sa6t.jsView on unpkg

4268// src/services/feedbackService.ts L4269: var FEEDBACK_ENDPOINT = process.env.UIPATH_CLI_FEEDBACK_ENDPOINT || atob("[redacted]"); L4270: var PROJECT_ID = "10677";

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index-tqczrxct.jsView file

12Cross-file remote execution chain: dist/index-tqczrxct.js spawns dist/applicationinsights-s28k1t0d.js; helper contains network access plus dynamic code execution. L12: class CommanderError extends Error { L13: constructor(exitCode, code, message) { L14: super(message); ... L730: var EventEmitter = __require("node:events").EventEmitter; L731: var childProcess = __require("node:child_process"); L732: var path = __require("node:path"); ... L776: this._outputConfiguration = { L777: writeOut: (str) => process2.stdout.write(str), L778: writeErr: (str) => process2.stderr.write(str), ... L2366: "client", L2367: "private", L2368: "public",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-tqczrxct.jsView on unpkg · L12

dist/index.browser.jsView file

•path = dist/index.browser.js kind = oversized_source_file sizeBytes = 26859088 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.browser.jsView on unpkg

dist/index-h8cph72k.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-h8cph72k.jsView on unpkg

Source & flagged code

14 flagged · loading source

dist/applicationinsights-s28k1t0d.jsView file

11246exports.execAsync = undefined; L11247: var child_process = __require("child_process"); L11248: var util = __require("util");

High

Child Process

Package source references child process execution.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L11246

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L410

Findings

1 Critical9 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index-9d17sa6t.js

HighChild Processdist/applicationinsights-s28k1t0d.js

HighShelldist/index-vmj27s6h.js

HighCredential Redirect Persistencedist/index-9d17sa6t.js

HighCommand Output Exfiltrationdist/applicationinsights-s28k1t0d.js

HighSandbox Evasion Gated Capabilitydist/index-vmj27s6h.js

HighCloud Metadata Accessdist/applicationinsights-s28k1t0d.js

HighCross File Remote Execution Contextdist/index-tqczrxct.js

HighBase64 Obscured Urldist/index-9d17sa6t.js

HighSemantic Analysis Limiteddist/index-h8cph72k.js

MediumDynamic Requiredist/index-469jgr1w.js

Affected versions and remediation

This report applies to @uipath/cli@1.202.1.

See all versions of @uipath/cli for other recorded verdicts.

Review the evidence and your use of @uipath/cli@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 09:34:27.848Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code