registry / @uipath/context-grounding-tool / 1.203.0

@uipath/context-grounding-tool@1.203.0

Tool for context grounding operations via the UiPath Python SDK

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook or concrete attack behavior. The flagged Base64 use is a telemetry connection string, while the inspected telemetry and authentication paths include redaction and HTTPS validation.

Static reason

One or more suspicious static signals were detected.

Trigger

CLI invocation or package import, as selected by the consumer.

Impact

No confirmed malicious effect or attack surface was established.

Mechanism

The inspected code includes telemetry property redaction, HTTPS validation for token exchange authorities, and system browser detection.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes a CLI and library entrypoint, with no lifecycle scripts declared.
The flagged Base64 decoding is used for a telemetry connection string; telemetry properties are redacted before use.
Authority URLs for token exchange must use HTTPS.
The other flagged bundle checks the system browser through platform-specific commands.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 439 KB of source, external domains: cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com, www.python.org

Source & flagged code

6 flagged

dist/tool-a7njf12p.jsView file

Lines 2770-2810javascript

2770function isSensitiveName(name) {

2771 const tokens = nameTokens(name);

2772 for (let i = 0;i < tokens.length; i++) {

2773 const token = tokens[i];

2774 if (SENSITIVE_NAME_TOKENS.has(token)) {

2775 return true;

2776 }

2777 if (token === "key" || token === "keys") {

2778 const prev = tokens[i - 1];

2779 if (prev && SENSITIVE_KEY_PREFIXES.has(prev)) {

2780 return true;

2781 }

2782 }

2783 }

2784 return false;

2785}

2786function redactProperty(name, value) {

2787 if (value === undefined || value === null) {

2788 return;

2789 }

2790 if (isSensitiveName(name)) {

2791 return REDACTED;

2792 }

2793 if (typeof value === "boolean" || typeof value === "number") {

2794 return value;

2795 }

2796 if (typeof value !== "string") {

2797 return "[OBJECT]";

Low

Ai Review Evidence

The flagged Base64 decoding is used for a telemetry connection string; telemetry properties are redacted before use.

dist/tool-a7njf12p.jsView on unpkg · L2790

2798 }

2799 return isFreeFormValue(name, value) ? redactMessage(value) : redactValueDetectors(value);

2800}

2801function redactProperties(properties) {

2802 const out = {};

2803 for (const [name, value] of Object.entries(properties)) {

2804 const redacted = redactProperty(name, value);

2805 if (redacted !== undefined) {

2806 out[name] = redacted;

2807 }

2808 }

2809 return out;

2810}

Lines 3947-3988javascript

3947 }

3948 getState().commandStart = performance.now();

3949}

3950function recordCommandDuration(durationMs) {

3951 if (!timingsEnabled()) {

3952 return;

Lines 5899-5939javascript

5899var normalizeAndValidateBaseUrl = (rawUrl) => {

5900 let baseUrl = rawUrl;

5901 if (baseUrl.endsWith("/identity_/")) {

5902 baseUrl = baseUrl.slice(0

dist/index-sby22td6.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-sby22td6.jsView on unpkg

package.jsonView file

Lines 1-32json

2 "name": "@uipath/context-grounding-tool",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

6 flagged · loading source

dist/tool-a7njf12p.jsView file

3967var telemetryInstanceSlot = singleton("TelemetryService"); L3968: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L3969: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-a7njf12p.jsView on unpkg · L3967

5919} if (url.protocol !== "https:") { throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OID

Medium

Stripped Provenance Metadata

Authority URLs for token exchange must use HTTPS.

dist/tool-a7njf12p.jsView on unpkg · L5919

3968var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]

Low

Ai Review Evidence

The flagged Base64 decoding is used for a telemetry connection string; telemetry properties are redacted before use.

dist/tool-a7njf12p.jsView on unpkg · L3968

Findings

2 High3 Medium7 Low

HighBase64 Obscured Urldist/tool-a7njf12p.js

HighSemantic Analysis Limiteddist/index-sby22td6.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/tool-a7njf12p.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/tool-a7njf12p.js

Affected versions and remediation

This report applies to @uipath/context-grounding-tool@1.203.0.

See all versions of @uipath/context-grounding-tool for other recorded verdicts.

Review the evidence and your use of @uipath/context-grounding-tool@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:26:15.755Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code