@uipath/common@1.203.0

Common infrastructure needed by uip tools.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hooks or concrete malicious behavior. Scanner flags are explained by ordinary telemetry configuration and ZIP extraction code that validates destination paths.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Telemetry is used by package consumers; archive extraction occurs when its exported extraction functions are called.

Impact

No concrete attack behavior was established from the inspected source.

Mechanism

The telemetry code derives its ingestion origin from a connection string and has a default telemetry endpoint. ZIP extraction rejects absolute or escaping paths and checks destination paths before writing.

AI rationale

Evidence

dist/index.js

Network endpoints1

dc.services.visualstudio.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no lifecycle scripts and routes package imports to its dist entrypoints.
dist/index.js contains a bundled telemetry connection string and configurable ingestion origin, consistent with its telemetry functionality.
dist/zip.js rejects unsafe archive paths and checks extraction destinations against the target root.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 9 file(s), 2.50 MB of source, external domains: cloud.uipath.com, dc.services.visualstudio.com, github.com

Source & flagged code

6 flagged

dist/index.browser.jsView file

24291async function importPackagerTool(specifier) { L24292: const [importError, mod] = await catchError(import(specifier)); L24293: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L24291

dist/index.jsView file

Lines 10570-10611javascript

10570 continue;

10571 }

10572 if (now - stats.mtimeMs > MAX_SPOOL_AGE_MS) {

10573 await catchError(fs7.rm(filePath));

10574 continue;

10575 }

10576 if (name.endsWith(PENDING_SUFFIX)) {

10577 pending.push({ path: filePath, mtimeMs: stats.mtimeMs });

10578 }

10579 }

10580 if (pending.length > MAX_SPOOL_FILES) {

10581 pending.sort((a, b) => a.mtimeMs - b.mtimeMs);

10582 const excess = pending.slice(0, pending.length - MAX_SPOOL_FILES);

10583 for (const file of excess) {

10584 await catchError(fs7.rm(file.path));

10585 }

10586 logger.debug(`[TelemetrySpool] deleted ${excess.length} oldest files over the ${MAX_SPOOL_FILES}-file cap`);

10587 }

10588}

10589

10590// src/telemetry/telemetry-init.ts

10591var telemetryInstanceSlot = singleton("TelemetryService");

10592var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

Low

Ai Review Evidence

dist/index.js contains a bundled telemetry connection string and configurable ingestion origin, consistent with its telemetry functionality.

dist/index.jsView on unpkg · L10590

10593function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L10591

10594 return process.env.UIPATH_AI_CONNECTION_STRING || DEFAULT_AI_CONNECTION_STRING;

10595}

10596var DEFAULT_INGESTION_ORIGIN = "https://dc.services.visualstudio.com";

10597function getTelemetryIngestionOrigin() {

10598 for (const part of getConnectionString().split(";")) {

10599 const separator = part.indexOf("=");

10600 if (separator === -1) {

10601 continue;

10602 }

10603 if (part.slice(0, separator).trim().toLowerCase() !== "ingestionendpoint") {

10604 continue;

10605 }

10606 const [error, url] = catchError(() => new URL(part.slice(separator + 1).trim()));

10607 return error ? DEFAULT_INGESTION_ORIGIN : url.origin;

10608 }

10609 return DEFAULT_INGESTION_ORIGIN;

10610}

10611async function createAppInsightsProvider() {

dist/zip.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/zip.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/common@1.202.1 matchedIdentity = npm:QHVpcGF0aC9jb21tb24:1.202.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/zip.jsView on unpkg

package.jsonView file

Lines 1-35json

2 "name": "@uipath/common",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

6 flagged · loading source

dist/index.browser.jsView file

24291async function importPackagerTool(specifier) { L24292: const [importError, mod] = await catchError(import(specifier)); L24293: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L24291

dist/index.jsView file

10591var telemetryInstanceSlot = singleton("TelemetryService"); L10592: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L10593: function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L10591

10590// src/telemetry/telemetry-init.ts var telemetryInstanceSlot = singleton("TelemetryService"); var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]

Low

Ai Review Evidence

dist/index.js contains a bundled telemetry connection string and configurable ingestion origin, consistent with its telemetry functionality.

Findings

3 High2 Medium7 Low

HighBase64 Obscured Urldist/index.js

HighSemantic Analysis Limiteddist/zip.js

HighPrevious Version Dangerous Deltadist/zip.js

MediumDynamic Requiredist/index.browser.js

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/common@1.203.0.

See all versions of @uipath/common for other recorded verdicts.

Review the evidence and your use of @uipath/common@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:27:29.508Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code