registry / Credential exfiltration / @uipath/llmgw-tool / 1.202.0

@uipath/llmgw-tool@1.202.0

CLI plugin for UiPath AI Trust Layer Bring-Your-Own LLM connections.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

The package has no lifecycle hook, but its refresh flow can forward an existing credential to an unrestricted configured HTTPS authority. This meets the conditional credential-exposure warning policy.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A stored access token is expired and token refresh runs.

Impact

A hostile or misconfigured authority could receive the refresh token.

Mechanism

The code resolves a configurable authority, derives its token endpoint, and posts the stored refresh token to it.

AI rationale

Evidence

dist/tool-9d4fj5ks.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The refresh endpoint can be selected from an authority argument or UIPATH_URL.
An expired stored refresh token is passed to the selected token endpoint.
The refresh request sends the refresh token in a POST body.

Evidence against

package.json has no lifecycle scripts.
The endpoint requires HTTPS, and returned tokens are checked against the expected authority.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 488 KB of source, external domains: cloud.uipath.com, github.com, govcloud.uipath.us, npm.pkg.github.com

Source & flagged code

6 flagged

dist/tool-9d4fj5ks.jsView file

Lines 4335-4375javascript

4335 }

4336 getState().commandStart = performance.now();

4337}

4338function recordCommandDuration(durationMs) {

4339 if (!timingsEnabled()) {

4340 return;

4341 }

4342 getState().commandMs = durationMs;

4343}

4344// ../../common/src/telemetry/proxy-http-agent.ts

4345var slot = singleton("ProxyAuthHttpsAgent");

4346

4347// ../../common/src/telemetry/node-appinsights-telemetry-provider.ts

4348var providerSlot = singleton("TelemetryProvider");

4349

4350// ../../common/src/telemetry/telemetry-spool.ts

4351var sidecarEntrySlot = singleton("TelemetrySidecarEntry");

4352var MAX_SPOOL_AGE_MS = 72 * 60 * 60 * 1000;

4353

4354// ../../common/src/telemetry/telemetry-init.ts

4355var telemetryInstanceSlot = singleton("TelemetryService");

4356var DEFAULT_AI_CONNECTION_STRING = atob("SW5zdHJ1bWVudGF0aW9uS2V5PTliZDM3NDgyLTgxMGUtNDQyYS1hYWE2LWQzOGVmNjVjNjY3NDtJbmdlc3Rpb25FbmRwb2ludD1odHRwczovL3dlc3RldXJvcGUtNS5pbi5hcHBsaWNhdGlvbmluc2lnaHRzLmF6dXJlLmNvbS87TGl2ZUVuZHBvaW50PWh0dHBzOi8vd2VzdGV1cm9wZS5saXZlZGlhZ25vc3RpY3MubW9uaXRvci5henVyZS5jb20vO0FwcGxpY2F0aW9uSWQ9MzU2OTdlZjEtOGJkMC00ZjE5LWEyN2MtZDg3Y2NhYzY2ZDJj");

4357function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-9d4fj5ks.jsView on unpkg · L4355

4358 const existing = telemetryInstanceSlot.get();

4359 if (existing && typeof existing === "object" && "trackEvent" in existing && typeof existing.trackEvent === "function") {

4360 return existing;

4361 }

4362 return;

4363}

4364function setGlobalTelemetryInstance(instance) {

4365 telemetryInstanceSlot.set(instance);

4366}

4367var _localTelemetryInstance;

4368function getTelemetryInstance() {

4369 const global = getGlobalTelemetryInstance();

4370 if (global)

4371 return global;

4372 if (!_localTelemetryInstance) {

4373 _localTelemetryInstance = new TelemetryService(new LoggerTelemetryProvider, new NodeContextStorage);

4374 setGlobalTelemetryInstance(_localTelemetryInstance);

4375 }

Lines 6666-6706javascript

6666 if (!hasScheme && hostCandidate.includes(".")) {

6667 baseUrl = `https://${baseUrl}`;

6668 }

6669 const resolvedBaseUrl = baseUrl;

6670

Lines 7200-7240javascript

7200 issuer: issuerFromToken

7201 };

7202 } catch {

7203 return;

7204 } finally {

7205 await catchError2(() => withTimeout(proxy.CloseAsync(), CLOSE_TIMEOUT_MS

Lines 7766-7806javascript

7766 tokenRefresh: {

7767 attempted: false,

7768 success: false,

7769 errorMessage: `auth file read failed: ${errorMessage(error)}`

7770 }

7771 }

dist/index-xnzgkhtg.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-xnzgkhtg.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/llmgw-tool@1.201.0 matchedIdentity = npm:QHVpcGF0aC9sbG1ndy10b29s:1.201.0 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-xnzgkhtg.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/tool-9d4fj5ks.jsView file

4355var telemetryInstanceSlot = singleton("TelemetryService"); L4356: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L4357: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/tool-9d4fj5ks.jsView on unpkg · L4355

6686var resolveConfigAsync = async ({ customAuthority, customClientId, customClientSecret, customClientAssertion, customScopes } = {}) => { const fileAuth = getAuthFileConfig(); let baseUrl = customAuthority; if (!baseUrl) { baseUrl = process.env.UIPATH_URL; } if (!baseUrl && fileAuth.authority) { baseUrl

Medium

Stripped Provenance Metadata

The refresh endpoint can be selected from an authority argument or UIPATH_URL.

dist/tool-9d4fj5ks.jsView on unpkg · L6686

7786const tokenForIdP = fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken; let refreshedAccess; let refreshedRefresh; try { const config = await resolveConfig({ customAuthority }); const refreshed = await refreshFn({ refreshToken: tokenForIdP, tokenEndpoint: config.tokenEndpoint, clientId: config.cli

Medium

Findings

3 High5 Medium4 Low

HighBase64 Obscured Urldist/tool-9d4fj5ks.js

HighSemantic Analysis Limiteddist/index-xnzgkhtg.js

HighPrevious Version Dangerous Deltadist/index-xnzgkhtg.js

MediumNetwork

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/tool-9d4fj5ks.js

MediumAi Review Evidencedist/tool-9d4fj5ks.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @uipath/llmgw-tool@1.202.0.

See all versions of @uipath/llmgw-tool for other recorded verdicts.

Review the evidence and your use of @uipath/llmgw-tool@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:43:48.423Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code