registry / @uipath/maestro-tool / 1.203.0

@uipath/maestro-tool@1.203.0

Create, debug, and run Maestro projects and jobs.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The required source paths were inspected: the manifest has no lifecycle hooks, the encoded string is telemetry configuration, and the oversized file shows bundled ELK library code. These findings do not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Package use through its declared entrypoints.

Impact

No concrete malicious effect was established from the inspected source.

Mechanism

The inspected flagged source configures application telemetry; the oversized bundle exposes ELK as a global library.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to package entrypoints under dist and defines no lifecycle scripts.
The flagged endpoint string initializes a telemetry connection string for an application insights service.
The large flagged file contains bundled ELK library code with a standard global export pattern.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 302 file(s), 37.9 MB of source, external domains: alpha.uipath.com, api.example.com, bpmn.io, bpmn.uipath.com, cloud.uipath.com, docs.uipath.com, fonts.googleapis.com, fonts.gstatic.com, github.com, govcloud.uipath.us, json-schema.org, npm.pkg.github.com, purl.org, raw.githubusercontent.com, schemas.microsoft.com, schemas.openxmlformats.org, serverlessworkflow.io, staging.uipath.com, uipath.com, uipath.org, www.apache.org, www.eclipse.org, www.omg.org, www.w3.org

Source & flagged code

6 flagged

dist/index.umd.min-fqefd9kn.jsView file

Lines 1814-1854javascript

1814 constructor(e2) {

1815 var t2;

1816 let n2;

1817 this.refs = {}, this.dynamicAnchors = {}, typeof e2.schema == "object" && (n2 = e2.schema), this.schema = e2.schema, this.schemaId = e2.schemaId, this.root = e2.root || this, this.baseId = (t2 = e2.baseId) !== null && t2 !== undefined ? t2 : (0, Ze.normalizeId)(n2 == null ? undefined : n2[e2.schemaId || "$id"]), this.schemaPath = e2.schemaPath, this.localRefs = e2.localRefs, this.meta = e2.meta, this.$async = n2 == null ? undefined : n2.$async, this.refs = {};

1818 }

1819 }

1820 function et(e2) {

1821 const t2 = nt.call(this, e2);

1822 if (t2)

1823 return t2;

1824 const n2 = (0, Ze.getFullPath)(this.opts.uriResolver, e2.root.baseId), { es5: r2, lines: o2 } = this.opts.code, { ownProperties: i2 } = this.opts, a2 =

1825 let s2;

1826 e2.$async && (s2 = a2.scopeValue("Error", { ref: Ke.default, code: He._`require("ajv/dist/runtime/validation_error").default` }));

1827 const l2 = a2.scopeName("validate");

1828 e2.validateName = l2;

1829 const c2 = { gen: a2, allErrors: this.opts.allErrors, data: Je.default.data, parentData: Je.default.parentData, parentDataProperty: Je.default.parentDataProperty, dataNames: [Je.default.data], dataPathArr: [He.nil], dataLevel: 0, dataTypes: [], definedProperties: new Set, topSchemaRef: a2.scopeValue("schema", this.opts.code.source === true ? { ref: e2.schema, code: (0, He.stringify)(e2.schema) } : { ref: e2.schema }), validateName: l2, ValidationError: s2, schema: e2.schema, schemaEnv: e2, rootId: n2, baseId: e2.baseId ||

1830 let u2;

1831 try {

1832 this._compilations.add(e2), (0, Qe.validateFunctionCode)(c2), a2.optimize(this.opts.code.optimize);

1833 const t3 = a2.toString();

1834 u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2));

1835 const n3 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get());

1836 if (this.scope.value(l2, { ref: n3 }), n3.errors = null, n3.schema = e2.schema, n3.schemaEnv = e2, e2.$async && (n3.$async = true), this.opts.code.source === true && (n3.source = { validateName: l2, validateCode: t3, scopeValues: a2._values }), this.opts.unevaluated) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.umd.min-fqefd9kn.js

1837 const { props: e3, items: t4 } = c2;

1838 n3.evaluated = { props: e3 instanceof He.Name ? undefined : e3, items: t4 instanceof He.Name ? undefined : t4, dynamicProps: e3 instanceof He.Name, dynamicItems: t4 instanceof

1839 }

1840 return e2.validate = n3, e2;

1841 } catch (t3) {

1842 throw delete e2.validate, delete e2.validateName, u2 && this.logger.error("Error compiling schema, function code:", u2), t3;

1843 } finally {

1844 this._compilations.delete(e2);

1845 }

1846 }

1847 function tt(e2) {

1848 return (0, Ze.inlineRef)(e2.schema, this.opts.inlineRefs) ? e2.schema : e2.validate ? e2 : et.call(this, e2);

1849 }

1850 function nt(e2) {

1851 for (const r2 of this._compilations)

1852 if (n2 = e2, (t2 = r2).schema === n2.schema && t2.root === n2.root && t2.baseId === n2.baseId)

1853 return r2;

1854 var t2, n2;

Long lines were clipped for display.

dist/packager-tool-zvy87b71.jsView file

54var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L55: var __require = /* @__PURE__ */ createRequire(import.meta.url); L56: var require_dist = __commonJS(function(exports, module) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packager-tool-zvy87b71.jsView on unpkg · L54

dist/node-mjsbcvzf.jsView file

10665var telemetryInstanceSlot = singleton("TelemetryService"); L10666: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]... L10667: function getGlobalTelemetryInstance() {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/node-mjsbcvzf.jsView on unpkg · L10665

•matchType = previous_version_dangerous_delta matchedPackage = @uipath/maestro-tool@1.202.2 matchedIdentity = npm:QHVpcGF0aC9tYWVzdHJvLXRvb2w:1.202.2 similarity = 0.483 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node-mjsbcvzf.jsView on unpkg

dist/headless-5kfya4w8.jsView file

•path = dist/headless-5kfya4w8.js kind = oversized_source_file sizeBytes = 10560608 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/headless-5kfya4w8.jsView on unpkg

dist/elk.bundled-vpsbxz0p.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/elk.bundled-vpsbxz0p.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.umd.min-fqefd9kn.jsView file

1834u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2)); L1835: const n3 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get()); L1836: if (this.scope.value(l2, { ref: n3 }), n3.errors = null, n3.schema = e2.schema, n3.schemaEnv = e2, e2.$async && (n3.$async = true), this.opts.code.source === true && (n3.source = {...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.umd.min-fqefd9kn.jsView on unpkg · L1834

dist/packager-tool-zvy87b71.jsView file

54var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L55: var __require = /* @__PURE__ */ createRequire(import.meta.url); L56: var require_dist = __commonJS(function(exports, module) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packager-tool-zvy87b71.jsView on unpkg · L54

Findings

3 High5 Medium6 Low

HighBase64 Obscured Urldist/node-mjsbcvzf.js

HighSemantic Analysis Limiteddist/elk.bundled-vpsbxz0p.js

HighPrevious Version Dangerous Deltadist/node-mjsbcvzf.js

MediumDynamic Requiredist/packager-tool-zvy87b71.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/headless-5kfya4w8.js

MediumStructural Risk Force Deep Review

LowEvaldist/index.umd.min-fqefd9kn.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @uipath/maestro-tool@1.203.0.

See all versions of @uipath/maestro-tool for other recorded verdicts.

Review the evidence and your use of @uipath/maestro-tool@1.203.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:03:34.127Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code