registry / @uipath/packager-tool-webapp / 1.202.0
@uipath/packager-tool-webapp@1.202.0
UiPath WebApp tool implementation
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks and exposes the package entry point through dist/index.js. Inspected implementation behavior is project packaging and metadata writing; no concrete attack surface was found.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes the exported WebApp packaging tool on a project.
Impact
No credential collection, network transmission, persistence, or destructive behavior was identified in the inspected source.
Mechanism
The tool reads project files, copies the compiled bundle, writes packaging metadata, and creates a NuGet package.
AI rationale
The manifest has no lifecycle hooks and exposes the package entry point through dist/index.js. Inspected implementation behavior is project packaging and metadata writing; no concrete attack surface was found.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js and declares a same-version core peer dependency; it defines no lifecycle scripts.
- The package copies a project bundle into an output folder and prepares package metadata when its pack operation is invoked.
- The metadata writer creates an operate model using the input project path and writes it into the package content folder.
Evidence against
Behavioral surface
Filesystem
UrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
5"type": "module",
"exports": {
".": "./dist/index.js"
},
"repository": {
"type": "git",
"url": "https://github.com/UiPath/cli.git",
"dire
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and declares a same-version core peer dependency; it defines no lifecycle scripts.
package.jsonView on unpkg · L5dist/index.jsView file
157const localBuildFolder = Path3.join(outputPath, NugetConstants.OutputFolderName);
const contentFolder = Path3.join(localBuildFolder, NugetConstants.ContentFolderName);
Low
Ai Review Evidence
The package copies a project bundle into an output folder and prepares package metadata when its pack operation is invoked.
dist/index.jsView on unpkg · L157194const operatePath = Path3.join(contentFolder, NugetConstants.OperateFileName);
const operateModel = {
projectId: await ensureWebAppProjectId(this.fileSystem, projectPath),
Findings
6 Low
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/packager-tool-webapp@1.202.0.
See all versions of @uipath/packager-tool-webapp for other recorded verdicts.
- Review the evidence and your use of @uipath/packager-tool-webapp@1.202.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.