registry / @uipath/packager-tool-functions / 1.202.0
@uipath/packager-tool-functions@1.202.0
UiPath Functions tool implementation
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest exposes a library entry point with no lifecycle script, and the inspected build code performs project packaging with filters for `.env` and credential-bearing `.npmrc` entries. No malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes the tool’s build operation.
Impact
No confirmed attack surface was established from the inspected source.
Mechanism
The tool reads project files and builds output in temporary storage; project-copy logic excludes `.env` and sanitizes selected `.npmrc` entries.
AI rationale
The manifest exposes a library entry point with no lifecycle script, and the inspected build code performs project packaging with filters for `.env` and credential-bearing `.npmrc` entries. No malicious behavior was identified.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library entry point and declares the matching core package as a peer dependency.
- Build logic excludes `.env` and removes UiPath-scoped or credential-bearing lines from copied `.npmrc` files.
- Build behavior is invoked through the tool’s build operation on a supplied project path.
Evidence against
Behavioral surface
Filesystem
UrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
5"type": "module",
"exports": {
".": "./dist/index.js"
},
"repository": {
"type": "git",
"url": "https://github.com/UiPath/cli.git",
"directory
Low
Suspicious Dependency Evidence
The manifest exposes a library entry point and declares the matching core package as a peer dependency.
package.jsonView on unpkg · L5dist/index.jsView file
14var EXCLUDED_NAMES = new Set([
"node_modules",
".git",
".env",
".deno",
"dist",
".uipath"
]);
var EXCLUDED_EXTENSIONS = [".nupkg"];
var NPMRC = ".npmrc";
var UIPATH_SCOPE = "@uipath:";
var CREDENTIAL_KEYS = ["_auth
Low
Ai Review Evidence
Build logic excludes `.env` and removes UiPath-scoped or credential-bearing lines from copied `.npmrc` files.
dist/index.jsView on unpkg · L1429function isOurs(line) {
const trimmed = line.trim();
if (isComment(trimmed))
return false;
const key = (trimmed.split("=")[0] ?? "").trim().toLowerCase();
return key.startsWith(UIPATH_SCOPE) || CREDENTIAL_KEYS.some((c) => key.endsWith(c))
Findings
7 Low
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/packager-tool-functions@1.202.0.
See all versions of @uipath/packager-tool-functions for other recorded verdicts.
- Review the evidence and your use of @uipath/packager-tool-functions@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.