@uipath/common@1.204.0

Common infrastructure needed by uip tools.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Source inspection found no lifecycle hooks or confirmed attack behavior. The flagged endpoint belongs to explicitly initialized, disableable telemetry, while the inspected zip and error utilities show ordinary library behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Telemetry runs only when a consumer calls the exported initialization API and tracking functions.

Impact

No confirmed attack impact was established.

Mechanism

The bundle configures a default telemetry connection, provides a disabling environment setting, and redacts tracked event properties.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json routes consumers to the Node and browser bundles and defines no lifecycle scripts.
The main bundle configures telemetry and exposes an environment setting that disables it; initialization is an explicit function call.
Telemetry event names and properties are passed through redaction before tracking.
The zip helper rejects absolute paths and paths that escape the destination root.
The error handler extracts and formats error details.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 10 file(s), 2.55 MB of source, external domains: cloud.uipath.com, dc.services.visualstudio.com, github.com

Source & flagged code

6 flagged

dist/index.browser.jsView file

24557async function importPackagerTool(specifier) { L24558: const [importError, mod] = await catchError(import(specifier)); L24559: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L24557

dist/index.jsView file

Lines 10773-10814javascript

10773 continue;

10774 }

10775 if (now - stats.mtimeMs > MAX_SPOOL_AGE_MS) {

10776 await catchError(fs7.rm(filePath));

10777 continue;

10778 }

10779 if (name.endsWith(PENDING_SUFFIX)) {

10780 pending.push({ path: filePath, mtimeMs: stats.mtimeMs });

10781 }

10782 }

10783 if (pending.length > MAX_SPOOL_FILES) {

10784 pending.sort((a, b) => a.mtimeMs - b.mtimeMs);

10785 const excess = pending.slice(0, pending.length - MAX_SPOOL_FILES);

10786 for (const file of excess) {

10787 await catchError(fs7.rm(file.path));

10788 }

10789 logger.debug(`[TelemetrySpool] deleted ${excess.length} oldest files over the ${MAX_SPOOL_FILES}-file cap`);

10790 }

10791}

10792

10793// src/telemetry/telemetry-init.ts

10794var telemetryInstanceSlot = singleton("TelemetryService");

10795var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

10796function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L10794

10797 return process.env.UIPATH_AI_CONNECTION_STRING || DEFAULT_AI_CONNECTION_STRING;

Low

Ai Review Evidence

The main bundle configures telemetry and exposes an environment setting that disables it; initialization is an explicit function call.

dist/index.jsView on unpkg · L10793

10798}

10799var DEFAULT_INGESTION_ORIGIN = "https://dc.services.visualstudio.com";

10800function getTelemetryIngestionOrigin() {

10801 for (const part of getConnectionString().split(";")) {

10802 const separator = part.indexOf("=");

10803 if (separator === -1) {

10804 continue;

10805 }

10806 if (part.slice(0, separator).trim().toLowerCase() !== "ingestionendpoint") {

10807 continue;

10808 }

10809 const [error, url] = catchError(() => new URL(part.slice(separator + 1).trim()));

10810 return error ? DEFAULT_INGESTION_ORIGIN : url.origin;

10811 }

10812 return DEFAULT_INGESTION_ORIGIN;

10813}

10814async function createAppInsightsProvider() {

dist/zip.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/zip.jsView on unpkg

dist/error-handler.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/common@1.203.0 matchedIdentity = npm:QHVpcGF0aC9jb21tb24:1.203.0 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/error-handler.jsView on unpkg

package.jsonView file

Lines 1-35json

2 "name": "@uipath/common",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.204.0",

Source & flagged code

6 flagged · loading source

dist/index.browser.jsView file

24557async function importPackagerTool(specifier) { L24558: const [importError, mod] = await catchError(import(specifier)); L24559: if (importError)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.browser.jsView on unpkg · L24557

dist/index.jsView file

10794var telemetryInstanceSlot = singleton("TelemetryService"); L10795: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L10796: function getConnectionString() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L10794

10793rc/telemetry/telemetry-init.ts var telemetryInstanceSlot = singleton("TelemetryService"); var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]"); function getConnectionString() { return proce

Low

Ai Review Evidence

The main bundle configures telemetry and exposes an environment setting that disables it; initialization is an explicit function call.

Findings

3 High2 Medium7 Low

HighBase64 Obscured Urldist/index.js

HighSemantic Analysis Limiteddist/zip.js

HighPrevious Version Dangerous Deltadist/error-handler.js

MediumDynamic Requiredist/index.browser.js

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/common@1.204.0.

See all versions of @uipath/common for other recorded verdicts.

Review the evidence and your use of @uipath/common@1.204.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 19:21:26.266Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code