@uipath/packager-tool-workflowcompiler-browser@1.201.0
UiPath Workflow Compiler tool - browser implementation
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source is a browser workflow-compiler integration with no install hook or stealth behavior. Its network calls are tied to caller-supplied UiPath connection data and explicit tool operations.
Static reason
No blocking static signals were detected.
Trigger
A consumer registers the factory and invokes pack, validate, or cleanup with connection context.
Impact
Expected compilation-related network and output-file operations only.
Mechanism
Remote UiPath job orchestration and result delivery.
AI rationale
The source is a browser workflow-compiler integration with no install hook or stealth behavior. Its network calls are tied to caller-supplied UiPath connection data and explicit tool operations.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a library entry point and contains no lifecycle scripts.
- Runtime networking uses the caller-provided cloud URL and access token to create a UiPath job.
- The package only runs when a consumer explicitly registers its tool factory.
Evidence against
- No install-time execution, shell commands, dynamic code execution, self-dependency, or credential harvesting was found.
- Network and file operations implement authenticated remote compilation and delivery of its output, not hidden exfiltration or persistence.
Behavioral surface
FilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
6"exports": {
".": {
"source": "./src/index.ts",
"default": "./dist/index.js"
}
}
Low
Suspicious Lifecycle Evidence
The manifest exposes a library entry point and contains no lifecycle scripts.
package.jsonView on unpkg · L6src/project-bundle-executor.tsView file
501const relativeBase = toRelativeUrl(connection.cloudUrl!);
const onLocalRobot =
context.jobTarget?.kind === PackJobTargetKind.LocalRobot;
// Two different job-creation APIs, not one endpoint with a flag: the serverless
// endpoint forces RuntimeType=Serverless and takes no machine targeting, while
// BeginSession takes the runtime/machine fields but no jobType. The agent behaves
// the same either way — it dispatches on Command in the input arguments.
const url = onLocalRobot
? `${relativeBase}/orchestrator_/api/Rob
Low
Ai Review Evidence
Runtime networking uses the caller-provided cloud URL and access token to create a UiPath job.
src/project-bundle-executor.tsView on unpkg · L501Findings
1 Medium5 Low
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/project-bundle-executor.ts
LowAi Review Evidencesrc/index.ts
Affected versions and remediation
This report applies to @uipath/packager-tool-workflowcompiler-browser@1.201.0.
See all versions of @uipath/packager-tool-workflowcompiler-browser for other recorded verdicts.
- Review the evidence and your use of @uipath/packager-tool-workflowcompiler-browser@1.201.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.