registry / @uipath/integrationservice-sdk / 1.202.0

@uipath/integrationservice-sdk@1.202.0

TypeScript SDK for UiPath Integration Service APIs (Connections and Elements).

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static review shows a normal UiPath SDK bundle without lifecycle scripts or an import-time attack. Bundled shell and registry helpers are unused until a caller invokes them and point at the product's own auth service.

Static reason

One or more suspicious static signals were detected.

Trigger

No install, import, or automatic runtime trigger starts an attack.

Impact

No unconsented mutation, exfiltration, or remote execution was established.

Mechanism

Entry code sets a user-agent on generated clients and exports caller-invoked API and auth helpers aimed at UiPath hosts.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Published package.json has no install lifecycle scripts, points main and exports at dist/index.js, and depends only on @uipath/integration-service-design-time.
Importing the bundle only installs an SDK user-agent header on generated API clients; shell, registry, and filesystem helpers stay inside functions.
Default authentication authority is https://cloud.uipath.com, aligned with the UiPath Integration Service client.

Evidence against

The bundle includes child_process, PowerShell, and Windows registry helpers from shared CLI libraries, but nothing invokes them at install or import time.
Ajv schema compilation uses Function, which is ordinary validator code generation rather than a hidden payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

5 flagged

dist/index.jsView file

88376var telemetryInstanceSlot = singleton("TelemetryService"); L88377: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L88378: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L88376

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

80var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS; var init_constants = __esm(()

Medium

Stripped Provenance Metadata

Default authentication authority is https://cloud.uipath.com, aligned with the UiPath Integration Service client.

dist/index.jsView on unpkg · L80

65385var SDK_USER_AGENT = getSdkUserAgentToken(package_default); installSdkUserAgentHeader(BaseAPI, SDK_USER_AGENT); installSdkUserAgentHeader(BaseAPI2, SDK_USER_AGE

Low

Ai Review Evidence

Importing the bundle only installs an SDK user-agent header on generated API clients; shell, registry, and filesystem helpers stay inside functions.

dist/index.jsView on unpkg · L65385

package.jsonView file

Lines 1-35json

2 "name": "@uipath/integrationservice-sdk",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.0",

5 "repository": {

6 "type"

Source & flagged code

5 flagged · loading source

dist/index.jsView file

88376var telemetryInstanceSlot = singleton("TelemetryService"); L88377: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L88378: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L88376

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

80var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS; var init_constants = __esm(()

Medium

Stripped Provenance Metadata

Default authentication authority is https://cloud.uipath.com, aligned with the UiPath Integration Service client.

dist/index.jsView on unpkg · L80

Findings

2 High3 Medium6 Low

HighBase64 Obscured Urldist/index.js

HighSemantic Analysis Limiteddist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumStripped Provenance Metadatadist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/integrationservice-sdk@1.202.0.

See all versions of @uipath/integrationservice-sdk for other recorded verdicts.

Review the evidence and your use of @uipath/integrationservice-sdk@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:54:52.258Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code