registry / @uipath/packager-tool-webapp / 1.202.1
@uipath/packager-tool-webapp@1.202.1
UiPath WebApp tool implementation
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks and points to a packaging tool entrypoint. Inspected code performs caller-invoked local packaging; no concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes the exported tool's packing operation.
Impact
No malicious effect was established; the observed behavior produces the requested package.
Mechanism
The tool copies a project bundle into an output folder, prepares metadata, and creates a NuGet package.
AI rationale
The manifest has no install lifecycle hooks and points to a packaging tool entrypoint. Inspected code performs caller-invoked local packaging; no concrete malicious behavior was found.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js and declares only a peer dependency; no lifecycle hooks are present.
- The implementation copies project bundle files into an output build folder and prepares package metadata when invoked.
- Packing requires caller-supplied project and output paths and delegates to a packaging strategy.
Evidence against
Behavioral surface
Filesystem
UrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
5"type": "module",
"exports": {
".": "./dist/index.js"
},
"repository": {
"type": "git",
"url": "https://github.com/
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and declares only a peer dependency; no lifecycle hooks are present.
package.jsonView on unpkg · L517"types": "./dist/index.d.ts",
"files": [
"dist"
],
"author": "",
"license": "SEE LICENSE IN LICENSE.txt",
"peerDependencies": {
"@uipath/solutionpackager-tool-core": "1.202.1"
},
"gitHead": "280b581b7893224d512dd
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and declares only a peer dependency; no lifecycle hooks are present.
package.jsonView on unpkg · L17dist/index.jsView file
53async function copyDirectoryAsync(fileSystem, sourcePath, destinationPath) {
await fileSystem.mkdir(destinationPath);
const entries = await fileSystem.readdir(sourcePa
Findings
7 Low
LowFilesystem
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @uipath/packager-tool-webapp@1.202.1.
See all versions of @uipath/packager-tool-webapp for other recorded verdicts.
- Review the evidence and your use of @uipath/packager-tool-webapp@1.202.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.