@uipath/gov-tool@1.200.0
Manage UiPath governance — AOps policies, Access policies, and compliance packs.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic review of package.json and dist/tool.js shows a first-party UiPath governance library with no lifecycle scripts and an export-only entry. Shell and auth helpers stay inside normal CLI behavior and are not an install-time attack.
Decision evidence
public snapshot- package.json names @uipath/gov-tool 1.200.0, points main and exports at ./dist/tool.js, and declares no scripts, bin, or dependencies.
- dist/tool.js is a governance CLI module that exports only registerCommands and metadata and does not start work on import.
- Bundled child_process helpers detect the OS default browser and are not install hooks.
- A base64 Application Insights connection string is assigned once and has no caller in this file.
Source & flagged code
4 flagged · loading sourceSource decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool.jsView on unpkg · L11819dist/tool.js is a governance CLI module that exports only registerCommands and metadata and does not start work on import.
dist/tool.jsView on unpkg · L23702dist/tool.js is a governance CLI module that exports only registerCommands and metadata and does not start work on import.
dist/tool.jsView on unpkg · L23730Findings
Affected versions and remediation
This report applies to @uipath/gov-tool@1.200.0.
See all versions of @uipath/gov-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/gov-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.