registry / @uipath/packager-tool-apiworkflow / 1.202.1
@uipath/packager-tool-apiworkflow@1.202.1
UiPath API Workflow tool implementation
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest exposes a library entry point and has no install lifecycle script; the inspected runtime code performs project packaging when invoked. No concrete malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes the exported tool’s build or pack operation.
Impact
The inspected code shows packaging-related file operations; it does not establish an attack surface.
Mechanism
The tool copies project files into a temporary build folder and creates package metadata.
AI rationale
The manifest exposes a library entry point and has no install lifecycle script; the inspected runtime code performs project packaging when invoked. No concrete malicious behavior was identified.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the package entry point and declares only a peer dependency.
- The exported tool builds a temporary package when buildAsync is called.
- Its file-copy routine reads project files and writes their contents to the build destination.
Evidence against
Behavioral surface
Filesystem
UrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
5"type": "module",
"exports": {
".": "./dist/index.js"
},
"repository": {
"type": "git",
"url": "https://github.com/UiPath/cli.git",
Low
Suspicious Dependency Evidence
package.json exposes dist/index.js as the package entry point and declares only a peer dependency.
package.jsonView on unpkg · L5dist/index.jsView file
415async buildAsync(options, _cancellationToken) {
const tempFolder = await this._temporaryStorage.getTempFolderPath();
const localBuildFolder = Path.join(tempFolder, NugetConstants.OutputFolderName);
const contentFolder = Path.join(localB
Low
Ai Review Evidence
The exported tool builds a temporary package when buildAsync is called.
dist/index.jsView on unpkg · L415459async copyFiles(sourcePath, destinationPath) {
await this.fileSystem.mkdir(destinationPath);
const files = await this.fileSystem.readdir(sourcePath);
for (const file of files) {
const sourceFile = Path.join(sou
Findings
6 Low
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/packager-tool-apiworkflow@1.202.1.
See all versions of @uipath/packager-tool-apiworkflow for other recorded verdicts.
- Review the evidence and your use of @uipath/packager-tool-apiworkflow@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.