@uipath/common@1.202.0

Common infrastructure needed by uip tools.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the inspected runtime telemetry behavior is explicitly configurable and has a local fallback. No concrete exfiltration, persistence, destructive action, or remote payload execution was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

No malicious trigger was identified.

Impact

No confirmed malicious impact was identified.

Mechanism

No malicious mechanism was identified.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes dist/index.js as the package entrypoint and contains no lifecycle-script field.
Telemetry can be disabled through UIPATH_TELEMETRY_DISABLED.
The telemetry provider uses a local logger fallback when disabled.

Evidence against

The runtime includes telemetry spooling under the user's .uipath directory when telemetry is used.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 8 file(s), 2.44 MB of source, external domains: cloud.uipath.com, dc.services.visualstudio.com, github.com

Source & flagged code

6 flagged

dist/index.browser.jsView file

24241async function importPackagerTool(specifier) { L24242: const [importError, mod] = await catchError(import(specifier)); L24243: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L24241

dist/index.jsView file

Lines 10404-10444javascript

10404 if (existing && typeof existing === "object" && "flush" in existing && typeof existing.flush === "function") {

10405 return existing;

10406 }

10407 if (existing instanceof Promise) {

10408 return existing;

10409 }

10410 const initPromise = (async () => {

10411 const provider = new NodeAppInsightsTelemetryProvider(connectionString);

10412 const ok = await provider.initialize();

10413 if (!ok) {

10414 providerSlot.clear();

10415 return;

10416 }

10417 providerSlot.set(provider);

10418 return provider;

10419 })();

10420 providerSlot.set(initPromise);

10421 return initPromise;

10422}

10423

10424// src/telemetry/telemetry-config.ts

10425function isTelemetryDisabled() {

10426 const value = process.env.UIPATH_TELEMETRY_DISABLED;

10427 return value === "1" || value === "true";

10428}

10429

10430// src/telemetry/telemetry-spool.ts

Low

Ai Review Evidence

Telemetry can be disabled through UIPATH_TELEMETRY_DISABLED.

dist/index.jsView on unpkg · L10424

10431var TELEMETRY_DRAIN_ARGV = "__uip-drain-telemetry";

10432var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

10433function setTelemetrySidecarEntry(entryPath) {

10434 sidecarEntrySlot.set(entryPath);

10435}

10436function getTelemetrySidecarEntry() {

10437 return sidecarEntrySlot.get();

10438}

10439var PENDING_SUFFIX = ".json";

10440var CLAIMED_SUFFIX = ".sending";

10441var WRITE_TEMP_SUFFIX = ".tmp";

10442var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

10443var MAX_SPOOL_FILES = 50;

10444function getTelemetrySpoolDir() {

Lines 10520-10585javascript

10520 }

10521 if (now - stats.mtimeMs > MAX_SPOOL_AGE_MS) {

10522 await catchError(fs7.rm(filePath));

10523 continue;

10524 }

10525 if (name.

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/common@1.201.0 matchedIdentity = npm:QHVpcGF0aC9jb21tb24:1.201.0 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

package.jsonView file

Lines 1-34json

2 "name": "@uipath/common",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.0",

5 "description": "Common infrastructure needed by uip tools.",

Source & flagged code

6 flagged · loading source

dist/index.browser.jsView file

24241async function importPackagerTool(specifier) { L24242: const [importError, mod] = await catchError(import(specifier)); L24243: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L24241

dist/index.jsView file

10540var telemetryInstanceSlot = singleton("TelemetryService"); L10541: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L10542: function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L10540

High

Previous Version Dangerous Delta

Findings

2 High2 Medium7 Low

HighBase64 Obscured Urldist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumDynamic Requiredist/index.browser.js

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/common@1.202.0.

See all versions of @uipath/common for other recorded verdicts.

Review the evidence and your use of @uipath/common@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:37:01.768Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code