registry / @uipath/conversational-tool / 1.202.0
@uipath/conversational-tool@1.202.0
Handle conversations with deployed UiPath conversational processes.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found a conventional UiPath conversational CLI with user-invoked commands and authenticated service requests. Package metadata contains no lifecycle hook or runtime self-dependency.
Static reason
One or more suspicious static signals were detected.
Trigger
User import or explicit command-line invocation.
Impact
No confirmed malicious behavior, persistence, destructive action, or unrelated credential export was identified.
Mechanism
Commands authenticate to and call the configured UiPath service; no install-time hook or hidden execution path was found.
AI rationale
Static inspection found a conventional UiPath conversational CLI with user-invoked commands and authenticated service requests. Package metadata contains no lifecycle hook or runtime self-dependency.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata exposes a library and an explicit command-line entry point.
- Authentication configuration normalizes the configured service base URL.
- The bundled browser opener requires a string target before invoking its opener.
- The command registration code exposes conversational chat, agent, conversation, exchange, message, trunk, and user-settings commands.
- Service requests use the authenticated session base URL and bearer token for the UiPath conversational API.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/tool-sz8zdfbv.jsView file
4411var telemetryInstanceSlot = singleton("TelemetryService");
L4412: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L4413: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-sz8zdfbv.jsView on unpkg · L44115967normalizeAndValidateBaseUrl = (rawUrl) => {
let baseUrl = rawUrl;
if (baseUrl.endsWith("/identity_/")) {
baseUrl = baseUrl.slice(0, -11);
} else if (baseUrl.endsWith("/identity_")) {
baseUrl = baseUrl.slice(0, -10);
}
while (baseUrl.endsWith("/")) {
baseUrl
Low
Ai Review Evidence
Authentication configuration normalizes the configured service base URL.
dist/tool-sz8zdfbv.jsView on unpkg · L5967dist/index-h8cph72k.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
Findings
2 High2 Medium8 Low
HighBase64 Obscured Urldist/tool-sz8zdfbv.js
HighSemantic Analysis Limiteddist/index-h8cph72k.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/tool-sz8zdfbv.js
LowAi Review Evidencedist/index-h8cph72k.js
LowAi Review Evidencedist/tool-9mezv9yv.js
Affected versions and remediation
This report applies to @uipath/conversational-tool@1.202.0.
See all versions of @uipath/conversational-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/conversational-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.