registry / @uipath/context-grounding-tool / 1.204.0
@uipath/context-grounding-tool@1.204.0
Tool for context grounding operations via the UiPath Python SDK
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged Base64 string and network-related signals do not establish an active attack: the inspected default telemetry path uses a local logger, and the package manifest defines no lifecycle scripts. Source review supports normal command-line tooling, so the verdict is clean.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the library or invoking the CLI and its user-selected commands.
Impact
No confirmed unauthorized data transfer, credential exposure, or other attack effect was established.
Mechanism
The entrypoints load the tool bundle; the default telemetry service routes events through the logger provider. The flagged helper code handles subprocess launches based on its options.
AI rationale
The flagged Base64 string and network-related signals do not establish an active attack: the inspected default telemetry path uses a local logger, and the package manifest defines no lifecycle scripts. Source review supports normal command-line tooling, so the verdict is clean.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/tool.js as its library entrypoint and dist/index.js as its CLI.
- The published entrypoints import the tool bundle; the CLI registers and parses user commands.
- The tool bundle creates its default telemetry service with a logger provider.
- That provider writes telemetry events and requests to the local logger; the encoded connection string did not establish active network transmission.
- The flagged index bundle contains standard open-library subprocess handling driven by its options.
Evidence against
- Static hints flag network use and a Base64 string, but inspected runtime code uses a logger-backed default provider.
- The package has no lifecycle scripts in its manifest.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/tool-rt648qgw.jsView file
4194var telemetryInstanceSlot = singleton("TelemetryService");
L4195: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L4196: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-rt648qgw.jsView on unpkg · L41944211if (!_localTelemetryInstance) {
_localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);
setGlobalTel
Low
Ai Review Evidence
The tool bundle creates its default telemetry service with a logger provider.
dist/tool-rt648qgw.jsView on unpkg · L4211dist/index-sby22td6.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High2 Medium8 Low
HighBase64 Obscured Urldist/tool-rt648qgw.js
HighSemantic Analysis Limiteddist/index-sby22td6.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/tool.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/tool-rt648qgw.js
Affected versions and remediation
This report applies to @uipath/context-grounding-tool@1.204.0.
See all versions of @uipath/context-grounding-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/context-grounding-tool@1.204.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.