@uipath/functions-tool: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@uipath/functions-tool: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/tool.jsView file

2var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json L4: var package_default = { ... L29: type: "git", L30: url: "https://github.com/UiPath/cli.git", L31: directory: "packages/functions-tool" ... L64: import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises"; ... L128: class CommanderError extends Error { L129: constructor(exitCode, code, message) { L130: super(message);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/tool.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> dist/tool.js L2: var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json L4: var package_default = { ... L29: type: "git", L30: url: "https://github.com/UiPath/cli.git", L31: directory: "packages/functions-tool" ... L64: import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises"; ... L128: class CommanderError extends Error { L129: constructor(exitCode, code, message) { L130: super(message);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L2

64import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/tool.jsView on unpkg · L64

1296} L1297: const execArgv = process9.execArgv ?? []; L1298: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L1296

24871(info) => { L24872: console.log(\`JS function node server listening on http://127.0.0.1:\${info.port}\`); L24873: signalReady(); ... L24878: const [bin, tsxPrefix] = resolveTsx(cwd); L24879: const proc = spawn(bin, [...tsxPrefix, "watch", ...envFileArgs, nodeEntryPath], { L24880: cwd, L24881: env: { ...process.env, HTTP_SERVER_LISTEN_PORT: String(port) }, L24882: stdio: "inherit"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tool.jsView on unpkg · L24871

22300Message: "Node.js not found. Install from https://nodejs.org (v20+).", L22301: Instructions: "Download and install Node.js v20 or later from https://nodejs.org" L22302: }); ... L22315: } L22316: const nodePath = execSync(`node -e "process.stdout.write(process.execPath)"`, { encoding: "utf-8" }).trim(); L22317: cache.node = { path: nodePath, version: nodeVersion };

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/tool.jsView on unpkg · L22300

2var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json L4: var package_default = { ... L29: type: "git", L30: url: "https://github.com/UiPath/cli.git", L31: directory: "packages/functions-tool" ... L64: import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises"; ... L128: class CommanderError extends Error { L129: constructor(exitCode, code, message) { L130: super(message);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tool.jsView on unpkg · L2

8162var telemetryInstanceSlot = singleton("TelemetryService"); L8163: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L8164: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool.jsView on unpkg · L8162

1import { createRequire } from "node:module"; L2: var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tool.jsView on unpkg · L1

Source & flagged code

9 flagged

dist/tool.jsView file

2var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json L4: var package_default = { ... L29: type: "git", L30: url: "https://github.com/UiPath/cli.git", L31: directory: "packages/functions-tool" ... L64: import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises"; ... L128: class CommanderError extends Error { L129: constructor(exitCode, code, message) { L130: super(message);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/tool.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> dist/tool.js L2: var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json L4: var package_default = { ... L29: type: "git", L30: url: "https://github.com/UiPath/cli.git", L31: directory: "packages/functions-tool" ... L64: import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises"; ... L128: class CommanderError extends Error { L129: constructor(exitCode, code, message) { L130: super(message);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tool.jsView on unpkg · L2

64import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/tool.jsView on unpkg · L64

1296} L1297: const execArgv = process9.execArgv ?? []; L1298: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/tool.jsView on unpkg · L1296

24871(info) => { L24872: console.log(\`JS function node server listening on http://127.0.0.1:\${info.port}\`); L24873: signalReady(); ... L24878: const [bin, tsxPrefix] = resolveTsx(cwd); L24879: const proc = spawn(bin, [...tsxPrefix, "watch", ...envFileArgs, nodeEntryPath], { L24880: cwd, L24881: env: { ...process.env, HTTP_SERVER_LISTEN_PORT: String(port) }, L24882: stdio: "inherit"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tool.jsView on unpkg · L24871

22300Message: "Node.js not found. Install from https://nodejs.org (v20+).", L22301: Instructions: "Download and install Node.js v20 or later from https://nodejs.org" L22302: }); ... L22315: } L22316: const nodePath = execSync(`node -e "process.stdout.write(process.execPath)"`, { encoding: "utf-8" }).trim(); L22317: cache.node = { path: nodePath, version: nodeVersion };

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/tool.jsView on unpkg · L22300

2var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json L4: var package_default = { ... L29: type: "git", L30: url: "https://github.com/UiPath/cli.git", L31: directory: "packages/functions-tool" ... L64: import { fileURLToPath } from "node:url"; L65: import childProcess3 from "node:child_process"; L66: import fs5, { constants as fsConstants2 } from "node:fs/promises"; ... L128: class CommanderError extends Error { L129: constructor(exitCode, code, message) { L130: super(message);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tool.jsView on unpkg · L2

8162var telemetryInstanceSlot = singleton("TelemetryService"); L8163: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L8164: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool.jsView on unpkg · L8162

1import { createRequire } from "node:module"; L2: var __require = /* @__PURE__ */ createRequire(import.meta.url); L3: // package.json

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tool.jsView on unpkg · L1