@uipath/common@1.200.0

Common infrastructure needed by uip tools.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found no lifecycle hook or active malicious behavior. The observed telemetry support is caller-initialized, disableable, and redacts properties.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

No install-time trigger exists; telemetry transport is initialized by a caller.

Impact

No confirmed unconsented execution, credential collection, exfiltration, persistence, or destructive behavior was found.

Mechanism

The entrypoint initializes a logger-backed telemetry service unless a caller initializes another provider.

AI rationale

Static inspection found no lifecycle hook or active malicious behavior. The observed telemetry support is caller-initialized, disableable, and redacts properties.

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a module entrypoint and contains no install lifecycle scripts.
The entrypoint defaults telemetry to a local logger; telemetry transport requires explicit initialization.
Telemetry can be disabled by an environment flag and properties are redacted before tracking.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 1.50 MB of source, external domains: cloud.uipath.com, github.com

Source & flagged code

7 flagged

dist/index.browser.jsView file

23346async function importPackagerTool(specifier) { L23347: const [importError, mod] = await catchError(import(specifier)); L23348: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L23346

dist/index.jsView file

Lines 9668-9708javascript

9668 }

9669 }

9670 }

9671 return false;

9672}

9673function redactProperty(name, value) {

9674 if (value === undefined || value === null) {

9675 return;

9676 }

9677 if (isSensitiveName(name)) {

9678 return REDACTED;

9679 }

9680 if (typeof value === "boolean" || typeof value === "number") {

9681 return value;

9682 }

9683 if (typeof value !== "string") {

9684 return "[OBJECT]";

9685 }

9686 return redactValueDetectors(value);

9687}

9688function redactProperties(properties) {

9689 const out = {};

9690 for (const [name, value] of Object.entries(properties)) {

9691 const redacted = redactProperty(name, value);

9692 if (redacted !== undefined) {

9693 out[name] = redacted;

Low

Ai Review Evidence

Telemetry can be disabled by an environment flag and properties are redacted before tracking.

dist/index.jsView on unpkg · L9688

9694 }

9695 }

9696 return out;

9697}

9698

9699// src/telemetry/telemetry-service.ts

9700var TELEMETRY_OPERATION_ID_PROPERTY = "uip.trace.operation_id";

9701var TELEMETRY_PARENT_ID_PROPERTY = "uip.trace.parent_id";

9702var TELEMETRY_SPAN_ID_PROPERTY = "uip.trace.span_id";

9703

9704class TelemetryService {

9705 telemetryProvider;

9706 contextStorage;

9707 operationId;

9708 defaultProperties;

Lines 10253-10293javascript

10253 if (existing && typeof existing === "object" && "flush" in existing && typeof existing.flush === "function") {

10254 return existing;

10255 }

Lines 10369-10449javascript

10369 }

10370 if (now - stats.mtimeMs > MAX_SPOOL_AGE_MS) {

10371 await catchError(fs7.rm(filePath));

10372 continue;

10373 }

10374 if (name.

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/common@1.201.0 matchedIdentity = npm:QHVpcGF0aC9jb21tb24:1.201.0 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

package.jsonView file

Lines 1-34json

2 "name": "@uipath/common",

3 "license": "MIT",

4 "version": "1.200.0",

5 "description": "Common infrastructure needed by uip tools.",

Source & flagged code

7 flagged · loading source

dist/index.browser.jsView file

23346async function importPackagerTool(specifier) { L23347: const [importError, mod] = await catchError(import(specifier)); L23348: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L23346

dist/index.jsView file

10389var telemetryInstanceSlot = singleton("TelemetryService"); L10390: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L10391: function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L10389

High

Previous Version Dangerous Delta

Findings

2 High2 Medium8 Low

HighBase64 Obscured Urldist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumDynamic Requiredist/index.browser.js

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/common@1.200.0.

See all versions of @uipath/common for other recorded verdicts.

Review the evidence and your use of @uipath/common@1.200.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:37:04.877Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code