@uipath/orchestrator-tool@1.203.0
Manage Orchestrator folders, jobs, processes, and releases.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected flagged code supports ordinary telemetry configuration, JWT parsing, and browser-opening functionality. No concrete attack surface was established, so the scanner signals do not support a warning or block.
Decision evidence
public snapshot- The manifest points to the tool bundle and CLI entry point and contains no lifecycle hook.
- The flagged Base64 literal configures an Application Insights connection string; it is not evidence of a hidden command endpoint.
- The other Base64 decoding code parses JWT payloads for token issuer validation.
- The flagged CLI bundle exports a browser-opening helper; the inspected excerpt shows no package-specific attack behavior.
Source & flagged code
6 flagged · loading sourceSource decodes a Base64-obscured HTTP endpoint at runtime.
dist/tool-adg53n3j.jsView on unpkg · L4169The flagged Base64 literal configures an Application Insights connection string; it is not evidence of a hidden command endpoint.
dist/tool-adg53n3j.jsView on unpkg · L4170The other Base64 decoding code parses JWT payloads for token issuer validation.
dist/tool-adg53n3j.jsView on unpkg · L27472Findings
Affected versions and remediation
This report applies to @uipath/orchestrator-tool@1.203.0.
See all versions of @uipath/orchestrator-tool for other recorded verdicts.
- Review the evidence and your use of @uipath/orchestrator-tool@1.203.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.