registry / @uipath/codedapp-tool / 1.202.1
@uipath/codedapp-tool@1.202.1
Build, pack, publish, deploy, and manage UiPath Coded Web Applications.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or active malicious behavior. Credential use and network requests are tied to user-supplied UiPath command configuration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes its CLI commands or library functions.
Impact
No unconsented installation-time execution, credential harvesting, destructive action, or persistence was found.
Mechanism
It loads configured credentials for commands and sends them to the configured UiPath service endpoint; its helper can open a browser target.
AI rationale
Static inspection found no lifecycle hook or active malicious behavior. Credential use and network requests are tied to user-supplied UiPath command configuration.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes library and CLI entrypoints and contains no lifecycle scripts.
- Commands are registered through a pre-action hook, so authentication loading follows CLI command invocation.
- API requests use configured UiPath base URL, token, tenant, and folder values.
- Telemetry properties are passed through a redaction routine.
- The browser-opening helper spawns a selected command with argument arrays.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/packager-tool-thnw8kwh.jsView file
118defaultWidth: 0,
L119: output: process.stdout,
L120: tty: __require("tty")
...
L142: }
L143: if (process.env.CLI_WIDTH) {
L144: const width = parseInt(process.env.CLI_WIDTH, 10);
...
L1440: `).split(`
L1441: `).map((line) => exec(line, columns, options)).join(`
L1442: `);
...
L7733: }
L7734: return this.encoder.write(str);
L7735: };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/packager-tool-thnw8kwh.jsView on unpkg · L118118Trigger-reachable chain: manifest.main -> dist/tool.js -> dist/packager-tool-thnw8kwh.js
L118: defaultWidth: 0,
L119: output: process.stdout,
L120: tty: __require("tty")
...
L142: }
L143: if (process.env.CLI_WIDTH) {
L144: const width = parseInt(process.env.CLI_WIDTH, 10);
...
L1440: `).split(`
L1441: `).map((line) => exec(line, columns, options)).join(`
L1442: `);
...
L7733: }
L7734: return this.encoder.write(str);
L7735: };
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/packager-tool-thnw8kwh.jsView on unpkg · L118•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/packager-tool-thnw8kwh.js:
function readline() {
const cleanFn = cb(readline());
function readlineWidth() {
return import_cli_width.default({ defaultWidth: 80, output: readline().output });
const width = readlineWidth();
import * as readline2 from "node:readline";
const width = readlineWidth();
const rl = readline2.createInterface({
Findings
2 Critical4 High3 Medium5 Low
CriticalCredential Exfiltrationdist/packager-tool-thnw8kwh.js
CriticalTrigger Reachable Dangerous Capabilitydist/packager-tool-thnw8kwh.js
HighCredential Redirect Persistencedist/packager-tool-thnw8kwh.js
HighTrigger Reachable Credential Exfiltrationdist/packager-tool-thnw8kwh.js
HighBase64 Obscured Urldist/packager-tool-58asqeb7.js
HighSemantic Analysis Limiteddist/index-h8cph72k.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Low
Affected versions and remediation
This report applies to @uipath/codedapp-tool@1.202.1.
See all versions of @uipath/codedapp-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/codedapp-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.