@uipath/gov-tool@1.202.1
Manage UiPath governance — AOps policies, Access policies, and compliance packs.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a UiPath governance command module with no install hooks and no import-time execution. Child process and cloud URL usage are inside explicit command registration, not an unconsented attack chain.
Decision evidence
public snapshot- package.json declares @uipath/gov-tool 1.202.1 with main and exports pointing at dist/tool.js and has no scripts, bin, or install lifecycle hooks.
- dist/tool.js only exports metadata and registerCommands for UiPath governance commands and does not execute on import.
- Bundled child_process and cloud.uipath.com usage sit inside user-invoked CLI helpers, not an install or import trigger.
Source & flagged code
4 flagged · loading sourceSource decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool.jsView on unpkg · L11988dist/tool.js only exports metadata and registerCommands for UiPath governance commands and does not execute on import.
dist/tool.jsView on unpkg · L24510dist/tool.js only exports metadata and registerCommands for UiPath governance commands and does not execute on import.
dist/tool.jsView on unpkg · L24482Findings
Affected versions and remediation
This report applies to @uipath/gov-tool@1.202.1.
See all versions of @uipath/gov-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/gov-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.