registry / @uipath/identity-tool / 1.201.0
@uipath/identity-tool@1.201.0
Manage Identity Server users, groups, robot accounts, and external apps.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install hook, persistence, credential harvesting, or exfiltration path was confirmed. The concealed telemetry configuration and incomplete analyzability justify a warning rather than a clean verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the identity-tool CLI or an identity-management command.
Impact
Potential telemetry transmission or local command launch during CLI use; no confirmed secret theft, persistence, or automatic execution was found.
Mechanism
CLI API client with obscured telemetry configuration and process spawning.
AI rationale
No concrete malicious install hook, persistence, credential harvesting, or exfiltration path was confirmed. The concealed telemetry configuration and incomplete analyzability justify a warning rather than a clean verdict.
Evidence
dist/tool-d7vkwb1n.jsdist/index-91ejywfm.js
Decision evidence
public snapshotAI called this Suspicious at 62.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package exposes a user-invoked CLI entry point.
- A bundled module decodes an obscured Application Insights connection string at import time.
- A bundled helper can spawn a platform command, leaving an unresolved command-execution surface despite no install hook.
Evidence against
- package.json has no preinstall, install, or postinstall script.
- The default telemetry provider writes telemetry to the logger and redacts properties.
- The inspected network client sends authenticated requests only as part of explicit identity-management commands.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/tool-d7vkwb1n.jsView file
3708var telemetryInstanceSlot = singleton("TelemetryService");
L3709: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L3710: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-d7vkwb1n.jsView on unpkg · L37083707// ../../common/src/telemetry/telemetry-init.ts
var telemetryInstanceSlot = singleton("TelemetryService");
var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]");
function getGlobalTelemetryInstance() {
Medium
Ai Review Evidence
A bundled module decodes an obscured Application Insights connection string at import time.
dist/tool-d7vkwb1n.jsView on unpkg · L3707dist/index-91ejywfm.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Findings
2 High5 Medium3 Low
HighBase64 Obscured Urldist/tool-d7vkwb1n.js
HighSemantic Analysis Limiteddist/index-91ejywfm.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/tool-d7vkwb1n.js
MediumSuspicious Lifecycle Evidencedist/index-91ejywfm.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @uipath/identity-tool@1.201.0.
See all versions of @uipath/identity-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/identity-tool@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.