registry / @uipath/packager-tool-apiworkflow / 1.202.0
@uipath/packager-tool-apiworkflow@1.202.0
UiPath API Workflow tool implementation
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook and exports a packaging tool whose inspected implementation copies project files and constructs package metadata. The inspected source provides no concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer invokes the exported tool's build or pack operation.
Impact
The inspected behavior produces a package; no attack impact was established.
Mechanism
The tool copies project files into a build directory, creates packaging metadata, and packages the result.
AI rationale
The manifest has no install lifecycle hook and exports a packaging tool whose inspected implementation copies project files and constructs package metadata. The inspected source provides no concrete malicious behavior.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js and contains no lifecycle scripts; its core dependency is a peer dependency.
- The exported tool copies project files into a build folder, creates packaging metadata, and delegates packaging to the NuGet packager.
Evidence against
Behavioral surface
Filesystem
UrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
5"type": "module",
"exports": {
".": "./dist/index.js"
},
"repository": {
"type": "git",
"url": "https://github.com/UiPath/cli.git",
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and contains no lifecycle scripts; its core dependency is a peer dependency.
package.jsonView on unpkg · L517"types": "./dist/index.d.ts",
"files": [
"dist"
],
"author": "",
"license": "SEE LICENSE IN LICENSE.txt",
"peerDependencies": {
"@uipath/solutionpackager-tool-core": "1.202.0"
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and contains no lifecycle scripts; its core dependency is a peer dependency.
package.jsonView on unpkg · L17dist/index.jsView file
420this.logger.progress(translate.t("toolApiworkflow.progress.copyingFiles"));
await this.copyFiles(options.projectPath, contentFolder);
this.logger.progress(translate.t("toolApiworkflow.progress.creatingOperateFile"));
await this.createOperateFile(options, c
Findings
7 Low
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/packager-tool-apiworkflow@1.202.0.
See all versions of @uipath/packager-tool-apiworkflow for other recorded verdicts.
- Review the evidence and your use of @uipath/packager-tool-apiworkflow@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.