registry / @uipath/orchestrator-tool / 1.202.1
@uipath/orchestrator-tool@1.202.1
Manage Orchestrator folders, jobs, processes, and releases.
AI Security Review
scanned 28d ago · by lpm-firewall-aiStatic inspection shows a first-party CLI with no lifecycle hooks and only user-invoked process and network behavior aligned with Orchestrator management. Registry reads and the bundled open helper do not form a covert install or exfiltration chain.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the orchestrator-tool binary or imports the module and invokes a command.
Impact
No unconsented install mutation, credential theft, or remote payload execution was established.
Mechanism
Commands talk to a configured UiPath authority and may open a local browser or read a local UiPath analytics registry value on Windows.
AI rationale
Static inspection shows a first-party CLI with no lifecycle hooks and only user-invoked process and network behavior aligned with Orchestrator management. Registry reads and the bundled open helper do not form a covert install or exfiltration chain.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares a CLI for Orchestrator management with bin orchestrator-tool and main dist/tool.js and has no install lifecycle scripts.
- The only child_process use in the tool bundle is a Windows-only execFileSync of reg query for the UiPath AnalyticsUniqueId registry value.
- dist/index-sby22td6.js is the vendored open helper that spawns a local process to open a URL, used from the user-run CLI rather than at install time.
Evidence against
- No eval, dynamic Function, preinstall/install/postinstall hooks, or self-dependency were found.
- Network calls target caller-configured UiPath Orchestrator and identity hosts after explicit CLI use, plus generated OpenAPI fallbacks.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/tool-2p58ckbh.jsView file
4148var telemetryInstanceSlot = singleton("TelemetryService");
L4149: var DEFAULT_AI_CONNECTION_STRING = atob("[redacted]...
L4150: function getGlobalTelemetryInstance() {
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-2p58ckbh.jsView on unpkg · L41483560import { execFileSync } from "node:child_process";
function readRegistryValue(keyPath, valueName) {
if (process.platform !== "win32") {
return "";
}
const [error, output]
Low
Ai Review Evidence
The only child_process use in the tool bundle is a Windows-only execFileSync of reg query for the UiPath AnalyticsUniqueId registry value.
dist/tool-2p58ckbh.jsView on unpkg · L3560dist/index-sby22td6.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Findings
2 High2 Medium7 Low
HighBase64 Obscured Urldist/tool-2p58ckbh.js
HighSemantic Analysis Limiteddist/index-sby22td6.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/tool-2p58ckbh.js
LowAi Review Evidencedist/index-sby22td6.js
Affected versions and remediation
This report applies to @uipath/orchestrator-tool@1.202.1.
See all versions of @uipath/orchestrator-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/orchestrator-tool@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.