registry / @uipath/integrationservice-sdk / 1.202.1

@uipath/integrationservice-sdk@1.202.1

TypeScript SDK for UiPath Integration Service APIs (Connections and Elements).

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found a normal SDK entry point without lifecycle hooks and an HTTPS-constrained OAuth flow. No concrete malicious behavior was identified.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the library and invokes its authentication or API features.

Impact

No unconsented installation behavior, credential harvesting, persistence, or destructive action was identified.

Mechanism

The library validates a configured HTTPS authority and performs OAuth token requests to that authority's token endpoint.

AI rationale

Static inspection found a normal SDK entry point without lifecycle hooks and an HTTPS-constrained OAuth flow. No concrete malicious behavior was identified.

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package metadata exposes only the bundled library entry point and declares no lifecycle scripts.
The library validates OAuth authority URLs as HTTPS and sends token exchanges to the configured token endpoint using a POST request.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 3.73 MB of source, external domains: alpha.uipath.com, cloud.uipath.com, github.com, govcloud.uipath.us, json-schema.org, npm.pkg.github.com, raw.githubusercontent.com, serverlessworkflow.io

Source & flagged code

6 flagged

dist/index.jsView file

88376var telemetryInstanceSlot = singleton("TelemetryService"); L88377: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L88378: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L88376

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

84363if (url.protocol !== "https:") { throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`); } return url.pathname.length > 1 ? url.origin : baseUrl; }; var resolveScopes = (isExternalAppAuth, customScopes

Medium

Stripped Provenance Metadata

The library validates OAuth authority URLs as HTTPS and sends token exchanges to the configured token endpoint using a POST request.

dist/index.jsView on unpkg · L84363

84934const tokenResponse = await fetch(tokenEndpoint, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: tokenParams }); const tokenData = await tokenResponse.json(); if (!tokenResponse.ok) { throw new TokenRefreshOAuthError; } const newAccessToken = tokenData.access_token; const newRefreshToken = tokenData.refresh_token; if (typeof newAccessTo

Medium

Stripped Provenance Metadata

The library validates OAuth authority URLs as HTTPS and sends token exchanges to the configured token endpoint using a POST request.

dist/index.jsView on unpkg · L84934

21425u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2)); L21426: const n4 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get()); L21427: if (this.scope.value(l3, { ref: n4 }), n4.errors = null, n4.schema = e2.schema, n4.schemaEnv = e2, e2.$async && (n4.$async = true), this.opts.code.source === true && (n4.source = {...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L21425

package.jsonView file

Lines 1-35json

2 "name": "@uipath/integrationservice-sdk",

3 "license": "SEE LICENSE IN LICENSE.txt",

4 "version": "1.202.1",

5 "repository": {

6 "type"

Source & flagged code

6 flagged · loading source

dist/index.jsView file

88376var telemetryInstanceSlot = singleton("TelemetryService"); L88377: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L88378: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L88376

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

Medium

Stripped Provenance Metadata

The library validates OAuth authority URLs as HTTPS and sends token exchanges to the configured token endpoint using a POST request.

dist/index.jsView on unpkg · L84363

Findings

2 High4 Medium6 Low

HighBase64 Obscured Urldist/index.js

HighSemantic Analysis Limiteddist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/index.js

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/integrationservice-sdk@1.202.1.

See all versions of @uipath/integrationservice-sdk for other recorded verdicts.

Review the evidence and your use of @uipath/integrationservice-sdk@1.202.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:54:33.051Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code