registry / @uipath/maestro-sdk / 1.202.0

@uipath/maestro-sdk@1.202.0

SDK for the UiPath Maestro (PIMS) API — process instance management.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection shows a published SDK without install hooks or a self-dependency chain. The cited helpers stay within local process input and UiPath registry paths, so the bundled shell and HTTP primitives do not form a concrete attack.

Static reason

One or more suspicious static signals were detected.

Trigger

No automatic install or import trigger starts an attack.

Impact

No credential theft, exfiltration, persistence, or unconsented agent-control mutation was established.

Mechanism

package.json has no lifecycle scripts or dependencies, and the cited modules only format traces, read stdin when called, or resolve local registry paths.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json names @uipath/maestro-sdk 1.202.0, points main at ./dist/index.js, and declares no scripts, dependencies, or install lifecycle hooks.
dist/shared-utils.js exports package and project name checks, trace formatters, and a TTY-aware readStdin helper.
dist/registry/snapshot.js resolves a local Maestro registry under the home .uipath directory or UIP_MAESTRO_REGISTRY_HOME and exports path helpers.

Evidence against

Bundled entry files import node:child_process and call fetch, which is ordinary CLI and API client code and is not wired to an install hook.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 10 file(s), 3.78 MB of source, external domains: bpmn.io, cloud.uipath.com, govcloud.uipath.us, www.omg.org, www.w3.org

Source & flagged code

5 flagged

dist/shared-utils.jsView file

Lines 105-149javascript

105 if (os.release().toLowerCase().includes("microsoft")) {

106 if (isInsideContainer()) {

107 return false;

108 }

109 return true;

110 }

111 try {

112 if (fs3.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {

113 return !isInsideContainer();

114 }

115 } catch {}

116 if (fs3.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs3.existsSync("/run/WSL")) {

117 return !isInsideContainer();

118 }

119 return false;

120}, is_wsl_default;

121var init_is_wsl = __esm(() => {

122 init_is_inside_container();

123 is_wsl_default = process2.env.__IS_WSL_TEST__ ? isWsl : isWsl();

124});

125

126// ../../node_modules/powershell-utils/index.js

127import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/shared-utils.jsView on unpkg · L125

128import { Buffer as Buffer2 } from "node:buffer";

129import { promisify } from "node:util";

130import childProcess from "node:child_process";

131var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell

132 const {

133 powerShellPath: psPath,

134 ...execFileOptions

135 } = options;

136 const encodedCommand = executePowerShell.encodeCommand(command);

137 return execFile(psPath ?? powerShellPath(), [

138 ...executePowerShell.argumentsPrefix,

139 encodedCommand

140 ], {

141 encoding: "utf8",

142 ...execFileOptions

143 });

144};

145var init_powershell_utils = __esm(() => {

146 execFile = promisify(childProcess.execFile);

147 executePowerShell.argumentsPrefix = [

148 "-NoProfile",

149 "-NonInteractive",

Lines 7636-7676javascript

7636function getTelemetryInstance() {

7637 const global = getGlobalTelemetryInstance();

7638 if (global)

7639 return global;

7640 if (!_localTelemetryInstance) {

7641

dist/registry/snapshot.jsView file

Lines 105-145javascript

105 if (os.release().toLowerCase().includes("microsoft")) {

106 if (isInsideContainer()) {

107 return false;

108 }

109

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10908724 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/shared-utils.jsView file

129import { promisify } from "node:util"; L130: import childProcess from "node:child_process"; L131: var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, executePowerS...

High

Child Process

Package source references child process execution.

dist/shared-utils.jsView on unpkg · L129

125L126: // ../../node_modules/powershell-utils/index.js L127: import process3 from "node:process";

High

Shell

Package source references shell execution.

dist/shared-utils.jsView on unpkg · L125

7656telemetryInstanceSlot = singleton("TelemetryService"); L7657: DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L7658: telemetry = new Proxy({}, {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/shared-utils.jsView on unpkg · L7656

Findings

4 High4 Medium4 Low

HighChild Processdist/shared-utils.js

HighShelldist/shared-utils.js

HighCross File Remote Execution Contextdist/registry/snapshot.js

HighBase64 Obscured Urldist/shared-utils.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @uipath/maestro-sdk@1.202.0.

See all versions of @uipath/maestro-sdk for other recorded verdicts.

Review the evidence and your use of @uipath/maestro-sdk@1.202.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 03:48:06.425Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code