registry / @uipath/llmgw-tool / 1.200.0
@uipath/llmgw-tool@1.200.0
CLI plugin for UiPath AI Trust Layer Bring-Your-Own LLM connections.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection found a normal CLI entrypoint, command registration, and HTTPS API client behavior. No malicious behavior or lifecycle hook was present.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the exported CLI commands.
Impact
No unconsented installation-time execution, persistence, harvesting, or exfiltration was identified.
Mechanism
The CLI sends JSON requests to the configured HTTPS UiPath authority.
AI rationale
Static inspection found a normal CLI entrypoint, command registration, and HTTPS API client behavior. No malicious behavior or lifecycle hook was present.
Network endpoints1
cloud.uipath.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes only a bundled module entrypoint and declares no lifecycle scripts.
- The bundle registers user-invoked commands for managing UiPath LLM connection configurations.
- Network requests use an HTTPS-validated authority and JSON API requests.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/tool-szxytghn.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/tool-szxytghn.js:
async writeFile(filePath, data) {
await fs6.writeFile(filePath, data);
await fs6.writeFile(lockFile, ownerId, { flag: "wx" });
await this.writeFile(destEntry, content);
function readLineBreak(state) {
readLineBreak(state);
readLineBreak(state);
readLineBreak(state);
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/tool-szxytghn.jsView on unpkg9546var telemetryInstanceSlot = singleton("TelemetryService");
L9547: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L9548: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-szxytghn.jsView on unpkg · L9546114452(() => new URL(resolvedBaseUrl));
if (urlError) {
throw new InvalidBaseUrlError(baseUrl, `Malformed URL. ${urlError instanceof Error ? urlError.message : "Unknown error"}`);
}
if (url.protocol !== "https:") {
throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
}
return url.pathname.length > 1 ? url.origin
Findings
2 High4 Medium5 Low
HighCredential Redirect Persistencedist/tool-szxytghn.js
HighBase64 Obscured Urldist/tool-szxytghn.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatadist/tool-szxytghn.js
MediumStripped Provenance Metadatadist/tool-szxytghn.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool-szxytghn.js
Affected versions and remediation
This report applies to @uipath/llmgw-tool@1.200.0.
See all versions of @uipath/llmgw-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/llmgw-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.