registry / @uipath/integrationservice-tool / 1.200.0
@uipath/integrationservice-tool@1.200.0
Manage Integration Service connectors, connections, and triggers.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection found no lifecycle hook, self-dependency, hidden execution path, or concrete malicious behavior. Network and local-server primitives are aligned with the interactive service CLI functionality.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the integrationservice-tool CLI.
Impact
No unconsented install-time execution, credential exfiltration, persistence, or destructive behavior was confirmed.
Mechanism
The binary registers and parses its declared service-management commands; authentication support uses a local callback server.
AI rationale
Static inspection found no lifecycle hook, self-dependency, hidden execution path, or concrete malicious behavior. Network and local-server primitives are aligned with the interactive service CLI functionality.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library entrypoint and a user-invoked CLI binary, with no lifecycle scripts or dependencies.
- The CLI entrypoint registers commands and parses command-line arguments only when the binary is run.
- The command bundle registers connector, connection, activity, resource, trigger, type-cache, and webhook commands.
- The authentication helper starts a local HTTP server for an interactive authentication callback.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/tool-d486kbjq.jsView file
739var EventEmitter = __require("node:events").EventEmitter;
L740: var childProcess = __require("node:child_process");
L741: var path = __require("node:path");
High
Child Process
Package source references child process execution.
dist/tool-d486kbjq.jsView on unpkg · L739•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/tool-d486kbjq.js:
Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
Utils.prototype.writeFileToAsync = function(path, content, overwrite, attr, callback) {
filetools.writeFileTo(childName, content2, overwrite, fileAttr2);
filetools.writeFileTo(target, content, overwrite, fileAttr);
filetools.writeFileTo(entryName, content, overwrite, fileAttr);
filetools.writeFileToAsync(filePath, content, overwrite, fileAttr, function(succ) {
var ok = filetools.writeFileTo(targetFileName, zipData, true);
filetools.writeFileToAsync(targetFileName, zipData, overwrite, perm, ret);
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/tool-d486kbjq.jsView on unpkg21Cross-file remote execution chain: dist/tool-d486kbjq.js spawns dist/tool-4f38v0ry.js; helper contains network access plus dynamic code execution.
L21: class CommanderError extends Error {
L22: constructor(exitCode, code, message) {
L23: super(message);
...
L739: var EventEmitter = __require("node:events").EventEmitter;
L740: var childProcess = __require("node:child_process");
L741: var path = __require("node:path");
...
L785: this._outputConfiguration = {
L786: writeOut: (str) => process2.stdout.write(str),
L787: writeErr: (str) => process2.stderr.write(str),
...
L2241: UNKNOWN_METHOD: "Invalid/unsupported compression method",
L2242: AVAIL_DATA: "inflate::Available inflate data did not terminate",
L2243: INVALID_DISTANCE: "inflate::Invalid literal/length or distance code in fixed or dynam
Findings
1 Critical5 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/tool-4f38v0ry.js
HighChild Processdist/tool-d486kbjq.js
HighCredential Redirect Persistencedist/tool-d486kbjq.js
HighCross File Remote Execution Contextdist/tool-d486kbjq.js
HighBase64 Obscured Urldist/tool-d486kbjq.js
HighSemantic Analysis Limiteddist/tool-4f38v0ry.js
MediumNetwork
MediumEnvironment Vars
LowEvaldist/index.umd.min-drpc57vn.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @uipath/integrationservice-tool@1.200.0.
See all versions of @uipath/integrationservice-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/integrationservice-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.