registry / @uipath/data-fabric-tool / 1.203.0
@uipath/data-fabric-tool@1.203.0
Manage Data Fabric entities and records.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe static hints resolve to ordinary platform browser-launching code and UiPath authority and API handling. The inspected package manifest has no install lifecycle hook, and the flagged source does not establish concealed endpoint use or credential exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user imports the library or invokes the command; API requests occur when tool operations run.
Impact
No confirmed attack surface was established from the inspected source.
Mechanism
The request code constructs service URLs from the configured base URL and adds a bearer token for those requests. No unrelated recipient or hidden endpoint was established.
AI rationale
The static hints resolve to ordinary platform browser-launching code and UiPath authority and API handling. The inspected package manifest has no install lifecycle hook, and the flagged source does not establish concealed endpoint use or credential exfiltration.
Network endpoints1
cloud.uipath.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a library entry and a command entry; it declares no lifecycle scripts.
- The flagged decoder normalizes UiPath authority URLs and enforces HTTPS; it does not decode an obscured endpoint.
- The flagged index bundle exports a browser-opening helper, consistent with its platform browser-launching code.
- API requests use the configured base URL and add the service bearer token to those requests.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/packager-tool-18mtxn00.jsView file
8868var telemetryInstanceSlot = singleton("TelemetryService");
L8869: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L8870: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/packager-tool-18mtxn00.jsView on unpkg · L886810821var normalizeAndValidateBaseUrl = (rawUrl) => {
let baseUrl = rawUrl;
if (baseUrl.endsWith("/identity_/")) {
baseUrl = baseUrl.slice(0, -11);
} else if (baseUrl.endsWith("/identity_")) {
baseUrl = baseUrl.slice(0, -1
Medium
Stripped Provenance Metadata
The flagged decoder normalizes UiPath authority URLs and enforces HTTPS; it does not decode an obscured endpoint.
dist/packager-tool-18mtxn00.jsView on unpkg · L10821dist/index-sby22td6.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
Findings
2 High3 Medium7 Low
HighBase64 Obscured Urldist/packager-tool-18mtxn00.js
HighSemantic Analysis Limiteddist/index-sby22td6.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/packager-tool-18mtxn00.js
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index-sby22td6.js
Affected versions and remediation
This report applies to @uipath/data-fabric-tool@1.203.0.
See all versions of @uipath/data-fabric-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/data-fabric-tool@1.203.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.