registry / @uipath/orchestrator-tool / 1.200.0
@uipath/orchestrator-tool@1.200.0
Manage Orchestrator folders, jobs, processes, and releases.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe inspected manifest has no lifecycle hook, and the active CLI path registers user-invoked management commands. No concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the declared CLI command.
Impact
No confirmed malicious impact or unconsented package action was established.
Mechanism
The entrypoint registers CLI commands and parses supplied arguments; no install-time execution was declared.
AI rationale
The inspected manifest has no lifecycle hook, and the active CLI path registers user-invoked management commands. No concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library entrypoint and a user-invoked CLI, with no lifecycle script declared.
- The CLI entrypoint registers commands and parses command-line arguments.
- The command bundle describes and registers Orchestrator management commands.
- The filesystem module exports ordinary local filesystem helpers.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/tool-s0a9arnc.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/tool-s0a9arnc.js:
function readLineBreak(state) {
readLineBreak(state);
readLineBreak(state);
readLineBreak(state);
await fs.writeFile(path, "");
"authorization",
headerParameters["Authorization"] = await this.configuration.accessToken("OAuth2", []);
headerParameters["Authorization"] = await this.configuration.accessToken("OAuth2", []);
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/tool-s0a9arnc.jsView on unpkg8711var telemetryInstanceSlot = singleton("TelemetryService");
L8712: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L8713: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-s0a9arnc.jsView on unpkg · L871149035var metadata = {
name: "orchestrator-tool",
version: package_default.version,
description: "Manage Orchestrator jobs, processes, packages, folders, machines, licenses, users, permissions, " + "assets, queues, queue items, buckets, libraries, triggers, and webhooks. " + "Supports the full automation lifecycle: deploy packages, create processes, execute jobs, provision machines, manage licenses, manage access, manage runtime resources (assets, queues, buckets, libraries), schedule triggers, and monitor results.",
commandPrefix: "or"
};
var register
Findings
4 High2 Medium6 Low
HighCredential Redirect Persistencedist/tool-s0a9arnc.js
HighBase64 Obscured Urldist/tool-s0a9arnc.js
HighSemantic Analysis Limiteddist/tool-mf36zc9b.js
HighPrevious Version Dangerous Deltadist/tool-mf36zc9b.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/tool-s0a9arnc.js
Affected versions and remediation
This report applies to @uipath/orchestrator-tool@1.200.0.
See all versions of @uipath/orchestrator-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/orchestrator-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.