registry / @uipath/identity-tool / 1.196.0

@uipath/identity-tool@1.196.0

Manage Identity Server users, groups, robot accounts, and external apps.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a UiPath admin CLI whose sensitive operations require user-invoked commands and existing UiPath auth context.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs identity-tool/admin CLI commands.

Impact

Expected management of UiPath users, groups, robot accounts, external apps, SMTP settings, PATs, and scopes.

Mechanism

UiPath identity management CLI with OAuth/API requests and local auth-file handling.

Rationale

Static inspection shows suspicious primitives are consistent with a legitimate UiPath CLI: user-invoked API calls, OAuth token refresh, optional Robot IPC fallback, logging, and bundled dependencies. There is no lifecycle hook, import-time exfiltration, persistence, destructive behavior, or unconsented execution path.

Evidence

package.jsondist/index.jsdist/tool.js.uipath/.auth

Network endpoints4

cloud.uipath.comalpha.uipath.com/identity_westeurope-5.in.applicationinsights.azure.com/westeurope.livediagnostics.monitor.azure.com/

@uipath/identity-tool@1.196.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code