registry / @uipath/maestro-sdk / 1.201.0

@uipath/maestro-sdk@1.201.0

SDK for the UiPath Maestro (PIMS) API — process instance management.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The suspicious primitives are bundled support code and configured API client behavior, not a concrete malicious chain. The package has no lifecycle hook or observed persistence, harvesting, or exfiltration behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the SDK and calls its API helpers.

Impact

Normal SDK API access; no unconsented installation-time action was found.

Mechanism

Authenticated requests to configured UiPath API paths.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes library entry points and contains no install lifecycle scripts.
The flagged PowerShell/base64 code is a bundled browser-launch helper, not an install hook or remote payload loader.
Network requests use a caller-provided UiPath API base URL and supplied bearer token.

Evidence against

No preinstall, install, postinstall, bin, or self-dependency is declared.
The registry export only derives UiPath registry paths and reads current.json.
No credential harvesting, arbitrary shell execution path, exfiltration endpoint, or persistence behavior was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 1.55 MB of source, external domains: bpmn.io, cloud.uipath.com, mths.be, uipath.org, www.omg.org, www.w3.org

Source & flagged code

6 flagged

dist/registry/snapshot.jsView file

Lines 103-147javascript

103 if (os.release().toLowerCase().includes("microsoft")) {

104 if (isInsideContainer()) {

105 return false;

106 }

107 return true;

108 }

109 try {

110 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

111 return !isInsideContainer();

112 }

113 } catch {}

114 if (fs3.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs3.existsSync("/run/WSL")) {

115 return !isInsideContainer();

116 }

117 return false;

118}, is_wsl_default;

119var init_is_wsl = __esm(() => {

120 init_is_inside_container();

121 is_wsl_default = process2.env.__IS_WSL_TEST__ ? isWsl : isWsl();

122});

123

124// ../../node_modules/powershell-utils/index.js

125import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/registry/snapshot.jsView on unpkg · L123

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/registry/snapshot.jsView on unpkg · L123

126import { Buffer as Buffer2 } from "node:buffer";

127import { promisify } from "node:util";

128import childProcess from "node:child_process";

129var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell

130 const {

131 powerShellPath: psPath,

132 ...execFileOptions

133 } = options;

134 const encodedCommand = executePowerShell.encodeCommand(command);

135 return execFile(psPath ?? powerShellPath(), [

136 ...executePowerShell.argumentsPrefix,

137 encodedCommand

138 ], {

139 encoding: "utf8",

140 ...execFileOptions

141 });

142};

143var init_powershell_utils = __esm(() => {

144 execFile = promisify(childProcess.execFile);

145 executePowerShell.argumentsPrefix = [

146 "-NoProfile",

147 "-NonInteractive",

Lines 9668-9708javascript

9668 hex = "";

9669 for (const byte of bytes) {

9670 hex += byte.toString(16).padStart(2, "0");

9671 }

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10663815 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

package.jsonView file

Lines 1-40json

2 "name": "@uipath/maestro-sdk",

3 "license": "MIT",

4 "version": "1.201.0",

5 "description": "SDK for the UiPath Maestro (PIMS) API — process instance management.",

Source & flagged code

6 flagged · loading source

dist/registry/snapshot.jsView file

127import { promisify } from "node:util"; L128: import childProcess from "node:child_process"; L129: var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, executePowerS...

High

Child Process

Package source references child process execution.

dist/registry/snapshot.jsView on unpkg · L127

123L124: // ../../node_modules/powershell-utils/index.js L125: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/registry/snapshot.jsView on unpkg · L123

123Cross-file remote execution chain: dist/registry/snapshot.js spawns dist/bpmn-packaging/index.js; helper contains network access plus dynamic code execution. L123: L124: // ../../node_modules/powershell-utils/index.js L125: import process3 from "node:process"; ... L151: ]; L152: executePowerShell.encodeCommand = (command) => Buffer2.from(command, "utf16le").toString("base64"); L153: executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`; ... L191: const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`; L192: const { stdout } = await executePowerShell(command, { powerShellPath: psPath }); L193: return stdout.trim(); ... L423: } L424: var fallbackAttemptSymbol, __dirn

Findings

4 High4 Medium4 Low

HighChild Processdist/registry/snapshot.js

HighShelldist/registry/snapshot.js

HighCross File Remote Execution Contextdist/registry/snapshot.js

HighBase64 Obscured Urldist/registry/snapshot.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @uipath/maestro-sdk@1.201.0.

See all versions of @uipath/maestro-sdk for other recorded verdicts.

Review the evidence and your use of @uipath/maestro-sdk@1.201.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 13:40:17.002Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code