registry / @uipath/codedagent-tool / 1.200.0

@uipath/codedagent-tool@1.200.0

Build, run, deploy, and manage AI Agents.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection shows a first-party CLI with no preinstall, install, or postinstall hooks and with network and process use tied to an https UiPath authority and a local uipath executable. Those behaviors match the package purpose and do not form a concrete attack chain.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the codedagent-tool binary or calls the exported init API.

Impact

Credentials stay with the configured UiPath service and the local Python tool. No foreign agent control surface or remote payload execution was found.

Mechanism

The process validates an https UiPath authority, refreshes tokens against that host, and spawns the local uipath Python executable with the requested command.

AI rationale

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes a module entry and codedagent-tool bin and defines no install lifecycle scripts.
The CLI spawns a cached local uipath executable with the caller command arguments and local auth environment only after command execution.
OAuth authorize and token URLs are built from an https-validated authority that defaults to https://cloud.uipath.com.
dist/tool-nvhfxv67.js is bundled filesystem and local-server helper code, not an install-time payload.

Evidence against

child_process and fetch are present, but they run from the user CLI or init API for UiPath Python and the configured UiPath identity host.
Python subcommands are limited to a local whitelist such as init, deploy, publish, and run.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/tool-5be0qe39.jsView file

Lines 1-39javascript

1import {

2 isBrowser

3} from "./tool-9qecd4wb.js";

4import {

5 catchError,

6 getFileSystem

7} from "./tool-nvhfxv67.js";

8import {

9 AUTH_FILENAME,

10 DEFAULT_BASE_URL,

11 UIPATH_HOME_DIR,

12 __commonJS,

13 __require,

14 __toESM

15} from "./tool-vc9mne6b.js";

17// ../../node_modules/commander/lib/error.js

18var require_error = __commonJS((exports) => {

19 class CommanderError extends Error {

20 constructor(exitCode, code, message) {

21 super(message);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/tool-5be0qe39.jsView on unpkg · L19

22 Error.captureStackTrace(this, this.constructor);

23 this.name = this.constructor.name;

24 this.code = code;

25 this.exitCode = exitCode;

26 this.nestedError = undefined;

27 }

28 }

30 class InvalidArgumentError extends CommanderError {

31 constructor(message) {

32 super(1, "commander.invalidArgument", message);

33 Error.captureStackTrace(this, this.constructor);

34 this.name = this.constructor.name;

35 }

36 }

37 exports.CommanderError = CommanderError;

38 exports.InvalidArgumentError = InvalidArgumentError;

39});

Lines 717-757javascript

717 });

718 similar.sort((a, b) => a.localeCompare(b));

719 if (searchingOptions) {

720 similar = similar.map((candidate) => `--${candidate}`);

Lines 8306-8346javascript

8306 const bytes = new Uint8Array(8);

8307 let hex = "";

8308 do {

8309 crypto.getRandomValues(bytes);

8310

Lines 9427-9467javascript

9427 if (!baseUrl && fileAuth.authority) {

9428 baseUrl = fileAuth.authority;

9429 }

9430 if (!baseUrl) {

9431 baseUrl = DEFAULT_BASE_URL;

9432 }

9433 baseUrl

Lines 10744-10784javascript

10744 const { authEnv, loginStatus: loginStatus2 } = await getAuthEnv();

10745 if (!loginStatus2) {

10746 logger.debug("Auth unavailable, continuing without credentials.");

10747 }

dist/tool-nvhfxv67.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tool-nvhfxv67.jsView on unpkg

package.jsonView file

Lines 1-31json

2 "name": "@uipath/codedagent-tool",

3 "license": "MIT",

4 "version": "1.200.0",

5 "description": "Build, run, deploy, and manage AI Agents.",

Source & flagged code

7 flagged · loading source

dist/tool-5be0qe39.jsView file

737var EventEmitter = __require("node:events").EventEmitter; L738: var childProcess = __require("node:child_process"); L739: var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist/tool-5be0qe39.jsView on unpkg · L737

19Cross-file remote execution chain: dist/tool-5be0qe39.js spawns dist/tool-nvhfxv67.js; helper contains network access plus dynamic code execution. L19: class CommanderError extends Error { L20: constructor(exitCode, code, message) { L21: super(message); ... L737: var EventEmitter = __require("node:events").EventEmitter; L738: var childProcess = __require("node:child_process"); L739: var path = __require("node:path"); ... L783: this._outputConfiguration = { L784: writeOut: (str) => process2.stdout.write(str), L785: writeErr: (str) => process2.stderr.write(str), ... L2640: try { L2641: const json = JSON.parse(text); L2642: return [json, true];

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/tool-5be0qe39.jsView on unpkg · L19

8326var telemetryInstanceSlot = singleton("TelemetryService"); L8327: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L8328: function getGlobalTelemetryInstance() {

Findings

4 High3 Medium5 Low

HighChild Processdist/tool-5be0qe39.js

HighCross File Remote Execution Contextdist/tool-5be0qe39.js

HighBase64 Obscured Urldist/tool-5be0qe39.js

HighSemantic Analysis Limiteddist/tool-nvhfxv67.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/tool-5be0qe39.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/tool-5be0qe39.js

Affected versions and remediation

This report applies to @uipath/codedagent-tool@1.200.0.

See all versions of @uipath/codedagent-tool for other recorded verdicts.

Review the evidence and your use of @uipath/codedagent-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:17:28.611Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code