registry / @uipath/integrationservice-sdk / 1.203.0

@uipath/integrationservice-sdk@1.203.0

TypeScript SDK for UiPath Integration Service APIs (Connections and Elements).

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The static hints are consistent with normal SDK networking and base64 pagination token decoding. The inspected request path uses a validated UiPath context for the bearer-token destination, and the manifest defines no install lifecycle hook.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller invokes the SDK request helper.

Impact

No untrusted credential destination or other confirmed attack surface was established in the inspected path.

Mechanism

The helper builds a POST request using the UiPath base URL, organization, and tenant from validated authentication context.

AI rationale

Network endpoints1

cloud.uipath.com

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes dist/index.js as the package entry point and has no lifecycle scripts.
The request helper obtains validated UiPath authentication context and sends its bearer token to a URL built from that context's base URL, organization, and tenant.

Evidence against

No concrete malicious behavior was identified in the inspected entry-point request path.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 3.75 MB of source, external domains: alpha.uipath.com, cloud.uipath.com, github.com, govcloud.uipath.us, json-schema.org, npm.pkg.github.com, raw.githubusercontent.com, serverlessworkflow.io

Source & flagged code

6 flagged

dist/index.jsView file

88387var telemetryInstanceSlot = singleton("TelemetryService"); L88388: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L88389: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L88387

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

21425u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2)); L21426: const n4 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get()); L21427: if (this.scope.value(l3, { ref: n4 }), n4.errors = null, n4.schema = e2.schema, n4.schemaEnv = e2, e2.$async && (n4.$async = true), this.opts.code.source === true && (n4.source = {...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L21425

90400function resolveExecuteUrl(ctx) { const base = ctx.baseUrl.replace(/\/+$/, ""); return `${base}/${ctx.organizationId}/${ctx.tenantName}/${EXECUTE_PATH}`; } async function executeRequest(input) { const options = input.tenant ? { tenant: input.tenant } : undefined; const { baseUrl, accessToken, organiza

Low

Ai Review Evidence

The request helper obtains validated UiPath authentication context and sends its bearer token to a URL built from that context's base URL, organization, and tenant.

dist/index.jsView on unpkg · L90400

90406const { baseUrl, accessToken, organizationId, tenantName } = await getValidatedAuthContext(options); const requestBody = buildRequestBody(input); const headers = { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}`, "X-UIPATH-OrganizationId": organizationId, "X-UIPATH-TenantId": tena

Low

Ai Review Evidence

The request helper obtains validated UiPath authentication context and sends its bearer token to a URL built from that context's base URL, organization, and tenant.

dist/index.jsView on unpkg · L90406

package.jsonView file

Lines 1-36json

2 "name": "@uipath/integrationservice-sdk",

3 "author": "UiPath",

4 "license": "SEE LICENSE IN LICENSE.txt",

5 "version": "1.203.0",

Source & flagged code

6 flagged · loading source

dist/index.jsView file

88387var telemetryInstanceSlot = singleton("TelemetryService"); L88388: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L88389: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L88387

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L21425

Findings

2 High2 Medium8 Low

HighBase64 Obscured Urldist/index.js

HighSemantic Analysis Limiteddist/index.js

MediumNetwork

MediumEnvironment Vars

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @uipath/integrationservice-sdk@1.203.0.

See all versions of @uipath/integrationservice-sdk for other recorded verdicts.

Review the evidence and your use of @uipath/integrationservice-sdk@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:15:57.371Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code