registry / @uipath/insights-tool / 1.200.0

@uipath/insights-tool@1.200.0

Query UiPath Insights data — jobs, failures, and performance metrics.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found a user-invoked UiPath Insights query CLI with no lifecycle hook. The authenticated request construction is aligned with its configured Insights API purpose.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the insights-tool CLI command.

Impact

No unconsented installation-time action, credential export, persistence, or destructive behavior was identified.

Mechanism

The CLI registers Insights job-query commands and sends authenticated requests to the configured Insights service path.

AI rationale

Static inspection found a user-invoked UiPath Insights query CLI with no lifecycle hook. The authenticated request construction is aligned with its configured Insights API purpose.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package metadata exposes a library entrypoint and a user-invoked CLI, with no lifecycle scripts.
The required support bundle defines a general environment and URL-opening adapter but no automatic invocation in the inspected entrypoints.
The Insights client builds authenticated requests to the configured UiPath Insights path.
The registered commands query Insights job data when invoked by the CLI.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 407 KB of source, external domains: cloud.uipath.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, npm.pkg.github.com, www.w3.org

Source & flagged code

7 flagged

dist/tool-nvhfxv67.jsView file

Lines 1-37javascript

1import {

2 AUTH_CANCELLED_ERROR_CODE,

3 DEFAULT_AUTH_TIMEOUT_MS,

4 __require

5} from "./tool-vc9mne6b.js";

7// ../filesystem/src/node.ts

8import { randomUUID } from "node:crypto";

9import { existsSync } from "node:fs";

10import * as fs6 from "node:fs/promises";

11import * as os2 from "node:os";

12import * as path2 from "node:path";

14// ../../node_modules/open/index.js

15import process8 from "node:process";

16import path from "node:path";

17import { fileURLToPath } from "node:url";

18import childProcess3 from "node:child_process";

19import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/tool-nvhfxv67.jsView on unpkg · L17

21// ../../node_modules/wsl-utils/index.js

22import { promisify as promisify2 } from "node:util";

23import childProcess2 from "node:child_process";

24import fs4, { constants as fsConstants } from "node:fs/promises";

26// ../../node_modules/wsl-utils/node_modules/is-wsl/index.js

27import process2 from "node:process";

28import os from "node:os";

29import fs3 from "node:fs";

31// ../../node_modules/is-inside-container/index.js

32import fs2 from "node:fs";

34// ../../node_modules/is-inside-container/node_modules/is-docker/index.js

35import fs from "node:fs";

36var isDockerCached;

37function hasDockerEnv() {

Lines 621-661javascript

621}));

622var open_default = open;

623

624// ../filesystem/src/node.ts

625var LOCK_HEARTBEAT_MS = 5000;

626var LOCK_STALE_MS = 15000;

627var

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tool-nvhfxv67.jsView on unpkg

dist/tool-6pha3g4p.jsView file

Lines 1-39javascript

1import {

2 isBrowser

3} from "./tool-9qecd4wb.js";

4import {

5 catchError,

6 getFileSystem

7} from "./tool-nvhfxv67.js";

8import

package.jsonView file

Lines 1-31json

2 "name": "@uipath/insights-tool",

3 "license": "MIT",

4 "version": "1.200.0",

5 "description": "Query UiPath Insights data — jobs, failures, and performance metrics.",

Source & flagged code

7 flagged · loading source

dist/tool-nvhfxv67.jsView file

17import { fileURLToPath } from "node:url"; L18: import childProcess3 from "node:child_process"; L19: import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/tool-nvhfxv67.jsView on unpkg · L17

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tool-nvhfxv67.jsView on unpkg

641env = { cwd: process.cwd, homedir: os2.homedir, tmpdir: os2.tmpdir, getenv: (key) => process.env[key] }; utils = { open: async (url) => { await open_default(url); }

Low

Ai Review Evidence

The required support bundle defines a general environment and URL-opening adapter but no automatic invocation in the inspected entrypoints.

dist/tool-nvhfxv67.jsView on unpkg · L641

Findings

4 High2 Medium6 Low

HighChild Processdist/tool-nvhfxv67.js

HighCross File Remote Execution Contextdist/tool-6pha3g4p.js

HighBase64 Obscured Urldist/tool-6pha3g4p.js

HighSemantic Analysis Limiteddist/tool-nvhfxv67.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/tool-nvhfxv67.js

LowAi Review Evidencedist/tool-6pha3g4p.js

Affected versions and remediation

This report applies to @uipath/insights-tool@1.200.0.

See all versions of @uipath/insights-tool for other recorded verdicts.

Review the evidence and your use of @uipath/insights-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:48:26.797Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code