@uipath/cli@1.203.0

Cross platform CLI for UiPath

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection did not substantiate the scanner's credential-redirection or install-time execution claims. The explicit Claude plugin setup remains a guarded first-party extension capability, warranting a warning under the agent integration policy.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user invokes the CLI's skills installation flow for Claude Code.

Impact

This can add or update a first-party UiPath extension in the user's Claude environment; no unconsented install-time attack was established.

Mechanism

The integration runs Claude commands to register a marketplace and install the UiPath plugin.

AI rationale

Evidence

dist/index-yc4we7bc.jsClaude configuration directory under .claude/plugins

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes its CLI through dist/index.js and defines no npm lifecycle hook in its manifest.
Claude configuration paths use CLAUDE_CONFIG_DIR or the user's .claude directory, and Claude is launched only by the integration code.
The Claude integration registers a marketplace and installs the UiPath plugin when its install handler runs.
Login status code identifies environment variables as a credential source; no inspected evidence showed those credentials redirected to an unofficial gateway.

Evidence against

The CLI can modify Claude Code's plugin marketplace and plugin installation through a user-invoked skills installation flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

13 flagged

dist/index-yc4we7bc.jsView file

Lines 15-55javascript

15import {

16 exports_external

17} from "./index-hrt7fpkk.js";

18import {

19 yaml

20} from "./index-d3w0wn6k.js";

21import {

22 getFileSystem

23} from "./index-xdxr3ync.js";

24import {

25 __commonJS,

26 __require,

27 __toESM

28} from "./index-1yh8g550.js";

30// ../../node_modules/cli-width/index.js

31var require_cli_width = __commonJS(function(exports, module) {

32 module.exports = cliWidth;

33 function normalizeOpts(options) {

34 const defaultOpts = {

35 defaultWidth: 0,

36 output: process.stdout,

37 tty: __require("tty")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index-yc4we7bc.jsView on unpkg · L35

38 };

39 if (!options) {

40 return defaultOpts;

41 }

42 Object.keys(defaultOpts).forEach(function(key) {

43 if (!options[key]) {

44 options[key] = defaultOpts[key];

45 }

46 });

47 return options;

48 }

49 function cliWidth(options) {

50 const opts = normalizeOpts(options);

51 if (opts.output.getWindowSize) {

52 return opts.output.getWindowSize()[0] || opts.defaultWidth;

53 }

54 if (opts.tty.getWindowSize) {

55 return opts.tty.getWindowSize()[1] || opts.defaultWidth;

Lines 939-983javascript

939async function resolveGlobalNpmUipathDir() {

940 const root = await runNpmRootGlobal();

941 if (!root) {

942 logger.debug("npm root -g lookup failed; skipping global plugin fallback");

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/cli@1.202.1 matchedIdentity = npm:QHVpcGF0aC9jbGk:1.202.1 similarity = 0.774 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-yc4we7bc.jsView on unpkg

dist/mcp-v3fca4s4.jsView file

Lines 2889-2929javascript

2889 validateName,

2890 ValidationError: _ValidationError,

2891 schema: sch.schema,

2892 schemaEnv: sch,

2893 rootId,

2894 baseId: sch.baseId || rootId,

2895 schemaPath

dist/index-469jgr1w.jsView file

Lines 59-99javascript

59 return new Md4(true).update(message)[outputType]();

60 };

61 };

62 var createMethod = function() {

dist/index-z079j80f.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-z079j80f.js: await this.fs.writeFile(path, content); await fs.writeFile(target.scriptPath, target.scriptContent); await fs.writeFile(target.rcPath, target.content); await fs.writeFile(target.rcPath, `${target.content} await fs.writeFile(target.rcPath, next); await fs.writeFile(target.rcPath, next); await fs.writeFile(tempPath, JSON.stringify(config, null, 4)); async fetchTenants(baseUrl, accessToken, organizationId) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-z079j80f.jsView on unpkg

dist/applicationinsights-s28k1t0d.jsView file

410this._logToConsole = true; L411: var logDestination = process.env.APPLICATIONINSIGHTS_LOG_DESTINATION; L412: if (logDestination == "file+console") { ... L428: } else { L429: this._tempDir = path.join(process.cwd(), logFilePath); L430: } ... L748: try { L749: var jsonConfig = JSON.parse(jsonString); L750: if (jsonConfig.disableStatsbeat != null) { ... L2650: try { L2651: moduleVersion = originalRequire.call(this, path.join(moduleId, "package.json")).version; L2652: } catch (e) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L410

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/applicationinsights-s28k1t0d.jsView on unpkg · L410

dist/index-nab7xkhc.jsView file

12Cross-file remote execution chain: dist/index-nab7xkhc.js spawns dist/applicationinsights-s28k1t0d.js; helper contains network access plus dynamic code execution. L12: class CommanderError extends Error { L13: constructor(exitCode, code, message) { L14: super(message); ... L730: var EventEmitter = __require("node:events").EventEmitter; L731: var childProcess = __require("node:child_process"); L732: var path = __require("node:path"); ... L776: this._outputConfiguration = { L777: writeOut: (str) => process2.stdout.write(str), L778: writeErr: (str) => process2.stderr.write(str), ... L2366: "client", L2367: "private", L2368: "public",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-nab7xkhc.jsView on unpkg · L12

4228var telemetryInstanceSlot = singleton("TelemetryService"); L4229: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L4230: function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index-nab7xkhc.jsView on unpkg · L4228

dist/index-h8cph72k.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-h8cph72k.jsView on unpkg

Source & flagged code

13 flagged · loading source

dist/index-yc4we7bc.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-yc4we7bc.jsView on unpkg

959async function runNpmRootGlobal() { L960: const { spawn } = await import("node:child_process"); L961: const isWindows = process.platform === "win32";

High

Child Process

Package source references child process execution.

dist/index-yc4we7bc.jsView on unpkg · L959

963const proc = isWindows ? spawn("npm root -g", [], { L964: shell: true, L965: stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/index-yc4we7bc.jsView on unpkg · L963

Findings

1 Critical9 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index-yc4we7bc.js

HighChild Processdist/index-yc4we7bc.js

HighShelldist/index-yc4we7bc.js

HighCredential Redirect Persistencedist/index-z079j80f.js

HighCommand Output Exfiltrationdist/applicationinsights-s28k1t0d.js

HighSandbox Evasion Gated Capabilitydist/index-yc4we7bc.js

HighCloud Metadata Accessdist/applicationinsights-s28k1t0d.js

HighCross File Remote Execution Contextdist/index-nab7xkhc.js

HighBase64 Obscured Urldist/index-nab7xkhc.js

HighSemantic Analysis Limiteddist/index-h8cph72k.js

MediumDynamic Requiredist/index-469jgr1w.js

Affected versions and remediation

This report applies to @uipath/cli@1.203.0.

See all versions of @uipath/cli for other recorded verdicts.

Review the evidence and your use of @uipath/cli@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:22:35.179Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code