registry / @uipath/insights-tool / 1.202.1

@uipath/insights-tool@1.202.1

Query UiPath Insights data — jobs, failures, and performance metrics.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found normal CLI registration and authenticated UiPath Insights API requests, with no lifecycle scripts or active attack behavior. The bundled browser-opening helper requires an explicit target.

Static reason

One or more suspicious static signals were detected.

Trigger

A user imports the library or runs its CLI.

Impact

No unconsented install-time execution, persistence, or exfiltration behavior was found.

Mechanism

It registers Insights commands and sends authenticated API requests to configured service routes.

AI rationale

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a library and CLI entrypoint and contains no lifecycle hook.
The tool registers Insights query commands for jobs, filters, alerts, and users.
Network requests use configured Insights routes and authenticated request headers.
The bundled open helper requires an explicit string target.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 463 KB of source, external domains: cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com

Source & flagged code

6 flagged

dist/tool-tbk23qsk.jsView file

Lines 4026-4066javascript

4026 }

4027 getState().commandStart = performance.now();

4028}

4029function recordCommandDuration(durationMs) {

4030 if (!timingsEnabled()) {

4031 return;

4032 }

4033 getState().commandMs = durationMs;

4034}

4035// ../common/src/telemetry/proxy-http-agent.ts

4036var slot = singleton("ProxyAuthHttpsAgent");

4037

4038// ../common/src/telemetry/node-appinsights-telemetry-provider.ts

4039var providerSlot = singleton("TelemetryProvider");

4040

4041// ../common/src/telemetry/telemetry-spool.ts

4042var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

4043var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

4044

4045// ../common/src/telemetry/telemetry-init.ts

4046var telemetryInstanceSlot = singleton("TelemetryService");

4047var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

4048function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-tbk23qsk.jsView on unpkg · L4046

4049 const existing = telemetryInstanceSlot.get();

4050 if (existing && typeof existing === "object" && "trackEvent" in existing && typeof existing.trackEvent === "function") {

4051 return existing;

4052 }

4053 return;

4054}

4055function setGlobalTelemetryInstance(instance) {

4056 telemetryInstanceSlot.set(instance);

4057}

4058var _localTelemetryInstance;

4059function getTelemetryInstance() {

4060 const global = getGlobalTelemetryInstance();

4061 if (global)

4062 return global;

4063 if (!_localTelemetryInstance) {

4064 _localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);

4065 setGlobalTelemetryInstance(_localTelemetryInstance);

4066 }

Lines 5745-5785javascript

5745 const seconds = Number.parseInt(header, 10);

5746 return Number.isNaN(seconds) || seconds < 0 ? undefined : seconds;

5747}

Lines 8502-8542javascript

8502 if (error.status !== 404) {

8503 return false;

8504 }

8505 writeRbacListNotFound(error, family.subject);

8506 return true;

8507 }

8508 });

dist/index-sby22td6.jsView file

Lines 516-556javascript

516 }

517 if (isFallbackAttempt) {

518 return new Promise((resolve, reject) => {

519 subprocess.once("error", reject);

520

package.jsonView file

Lines 1-31json

2 "name": "@uipath/insights-tool",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.1",

5 "description": "Query UiPath Insights data — jobs, failures, and performance metrics.",

Source & flagged code

6 flagged · loading source

dist/tool-tbk23qsk.jsView file

4046var telemetryInstanceSlot = singleton("TelemetryService"); L4047: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L4048: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-tbk23qsk.jsView on unpkg · L4046

8522hheldNote: PRINCIPAL_WITHHELD_NOTE, emptyNote: USERS_EMPTY_NOTE, noun: "user" }); }); } // src/tool.ts var metadata = { name: "insights-tool", version: package_default.version, description: "Query UiPath Insights data — jobs, failures, and performance metrics.", commandPrefix: "insights" }; var registerCommands = async (program2) => { registerJobsCommand(program2); registerFilterFoldersCommand(program2); registerFilterProcessesCommand(program2); registerFilte

Low

Ai Review Evidence

The tool registers Insights query commands for jobs, filters, alerts, and users.

dist/tool-tbk23qsk.jsView on unpkg · L8522

5765"organizationId", config.organizationId)}/${encodePathSegment(routeKey, "tenantName", config.tenantName)}/${SERVICE_ROOTS[route.service]}/${path2}`; const hasBody = request.body !== undefined; const [fetchError, response] = await catchError(fetch(url, { method: route.method, headers: buildServiceHeaders(config, route.service, hasBody), body: hasBody ? JSON.stringify(request.body)

Findings

2 High2 Medium8 Low

HighBase64 Obscured Urldist/tool-tbk23qsk.js

HighSemantic Analysis Limiteddist/index-sby22td6.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/tool-tbk23qsk.js

LowAi Review Evidencedist/index-sby22td6.js

Affected versions and remediation

This report applies to @uipath/insights-tool@1.202.1.

See all versions of @uipath/insights-tool for other recorded verdicts.

Review the evidence and your use of @uipath/insights-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:48:52.062Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code