@uipath/gov-tool@1.202.0
Manage UiPath governance — AOps policies, Access policies, and compliance packs.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a UiPath governance CLI module with no lifecycle scripts and an entry that only exports command registration. Child-process and HTTPS usage is inside ordinary CLI helpers and UiPath endpoints, not an install-time or covert attack chain.
Decision evidence
public snapshot- package.json names @uipath/gov-tool 1.202.0, points main and exports at dist/tool.js, and defines no scripts, bin, or install lifecycle hooks.
- dist/tool.js is an ESM bundle whose package entry only exports metadata and registerCommands for the gov CLI; it does not run commands, network calls, or file writes at import.
- Bundled helpers import node:child_process for browser and process utilities, but those calls sit inside functions and are not install or import triggers.
- Default HTTPS hosts are UiPath cloud and documentation URLs used by the governance client after a caller registers commands.
Source & flagged code
5 flagged · loading sourceSource decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool.jsView on unpkg · L11988dist/tool.js is an ESM bundle whose package entry only exports metadata and registerCommands for the gov CLI; it does not run commands, network calls, or file writes at import.
dist/tool.jsView on unpkg · L24482dist/tool.js is an ESM bundle whose package entry only exports metadata and registerCommands for the gov CLI; it does not run commands, network calls, or file writes at import.
dist/tool.jsView on unpkg · L24510Findings
Affected versions and remediation
This report applies to @uipath/gov-tool@1.202.0.
See all versions of @uipath/gov-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/gov-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.