registry / @uipath/gov-tool / 1.201.0
@uipath/gov-tool@1.201.0
Manage UiPath governance — AOps policies, Access policies, and compliance packs.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe static signals are explained by normal JWT parsing and authenticated API-client behavior. There are no lifecycle hooks or autonomous execution paths.
Static reason
One or more suspicious static signals were detected.
Trigger
An explicit UiPath governance CLI command.
Impact
User-requested policy and compliance-pack changes in the selected UiPath tenant.
Mechanism
Authenticated governance API client
AI rationale
The static signals are explained by normal JWT parsing and authenticated API-client behavior. There are no lifecycle hooks or autonomous execution paths.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest contains no lifecycle scripts; it only exposes the bundled module.
- The flagged Base64 operation parses the payload section of a JWT, not an obscured URL.
- Authentication traffic uses a validated HTTPS authority and its OIDC token endpoint.
Evidence against
- No install-time execution, self-dependency, or persistence mechanism was found.
- Network and credential handling are consistent with an authenticated UiPath governance CLI.
- Policy-changing operations are registered as explicit user-invoked commands.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/tool.jsView file
12041var telemetryInstanceSlot = singleton("TelemetryService");
L12042: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L12043: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool.jsView on unpkg · L1204122394const [urlError, url] = catchError3(() => new URL(resolvedBaseUrl));
if (urlError) {
throw new InvalidBaseUrlError2(baseUrl, `Malformed URL. ${urlError instanceof Error ? urlError.message : "Unknown error"}`);
}
if (url.protocol !== "https:") {
throw new InvalidBaseUrlError2(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
}
return url.pathname.length > 1 ? url.origin : baseUrl;
Medium
Stripped Provenance Metadata
Authentication traffic uses a validated HTTPS authority and its OIDC token endpoint.
dist/tool.jsView on unpkg · L2239422536var parseJWT2 = (token) => {
try {
const parts = token.split(".");
const base64Url = parts[1];
if (!base64Url) {
throw new Error("Invalid JWT token format - missing payload section");
}
const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
let decodedString;
if (isBrowser2() && typeof atob !== "undefined") {
decodedString = atob(base64);
} else {
decodedString = Buffer.from(base64, "base64").toString();
}
const jsonPayload = decodeURIComponent(decodedString.split("").map((c) => `%${`00${c.charCodeAt(0).toString(16)}`.slice(-
Findings
1 High3 Medium5 Low
HighBase64 Obscured Urldist/tool.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/tool.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool.js
Affected versions and remediation
This report applies to @uipath/gov-tool@1.201.0.
See all versions of @uipath/gov-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/gov-tool@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.