registry / @uipath/docsai-tool / 1.201.0
@uipath/docsai-tool@1.201.0
Search UiPath documentation with AI-powered answers.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe observed network behavior is consistent with an authenticated documentation-search CLI, and no persistence, harvesting, or install-time execution was found. The opaque telemetry endpoint and incomplete static coverage leave a limited unresolved risk.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the DocsAI CLI command while logged in.
Impact
A configured service receives the query and bearer credential; static inspection did not establish malicious use.
Mechanism
Authenticated HTTP client with an obscured telemetry configuration.
AI rationale
The observed network behavior is consistent with an authenticated documentation-search CLI, and no persistence, harvesting, or install-time execution was found. The opaque telemetry endpoint and incomplete static coverage leave a limited unresolved risk.
Evidence
dist/tool-fsb9sc78.js
Decision evidence
public snapshotAI called this Suspicious at 66.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest exposes an executable CLI entrypoint.
- The main bundle Base64-decodes a telemetry connection string, obscuring its endpoint.
- A bundled module imports process-launching and filesystem APIs for browser-opening support.
- The CLI sends the logged-in bearer token to a service URL derived from stored login state.
Evidence against
- package.json contains no lifecycle scripts or self-dependency.
- The DocsAI request is reached only after an explicit CLI ask command.
- The command requires an existing logged-in session before it creates the network client.
- The Base64 decoding is in telemetry initialization; the local default provider is a logger.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/tool-fsb9sc78.jsView file
10258var telemetryInstanceSlot = singleton("TelemetryService");
L10259: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L10260: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-fsb9sc78.jsView on unpkg · L1025810257// ../common/src/telemetry/telemetry-init.ts
var telemetryInstanceSlot = singleton("TelemetryService");
var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]");
function getGlobalTelemetryInstance() {
Medium
Ai Review Evidence
The main bundle Base64-decodes a telemetry connection string, obscuring its endpoint.
dist/tool-fsb9sc78.jsView on unpkg · L1025721640if (!status.organizationId) {
throw new Error("Organization ID not available. Run `uip login` to re-authenticate.");
}
const url2 = buildMcpUrl(status.baseUrl, status.organizationId, tenantName);
const transport = new StreamableHTTPClientTransport(url2, {
requestInit: {
headers: {
Authorization: `Bearer ${status.accessToken}`
}
}
});
const client = new Client(MCP_CLIENT_INFO, { capabilities: {} });
await client.connect(transport);
return createDocsAIClient(client);
}
Medium
Findings
2 High6 Medium4 Low
HighBase64 Obscured Urldist/tool-fsb9sc78.js
HighSemantic Analysis Limiteddist/index-hsadteg4.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/tool-fsb9sc78.js
MediumAi Review Evidencedist/index-hsadteg4.js
MediumAi Review Evidencedist/tool-fsb9sc78.js
LowEvaldist/tool-fsb9sc78.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @uipath/docsai-tool@1.201.0.
See all versions of @uipath/docsai-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/docsai-tool@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.